CVE-2026-25141 is a critical code injection flaw (CVSS 9.8) in Orval, the tool that generates TypeScript clients from OpenAPI and Swagger specifications. It is an incomplete fix for CVE-2026-23947. The escaping function still lets some characters through. Orval 7.21.0 and 8.2.0 contain the updated fix.
What's affected
- Affected: Orval from 7.19.0 up to, but not including, 7.21.0, and the 8.x line before 8.2.0.
- Fixed in: 7.21.0 and 8.2.0. Both releases note the CVE fix, and both are dated 30 January.
Orval is a build time tool, so exposure depends on where your specifications come from. A spec you wrote yourself is a different risk from one fetched from a third party or generated by a service you do not control.
How to check if you're exposed
Look for Orval in your project and in your CI.
npm ls orval
Check both the package manifest and the lockfile, because a caret range can resolve to a version in the affected window. Then list the sources of your OpenAPI documents. Anything pulled from outside your own repository deserves a second look.
What to do now
- Upgrade Orval to 7.21.0 or later on 7.x, or 8.2.0 or later on 8.x.
- Regenerate your clients after upgrading, so generated code comes from the fixed tool.
- Review generated code from the affected window if any of your specs came from untrusted sources.
- Run generation in CI with limited credentials and no access to production secrets.
- Review changes to specification files in pull requests, like any other code.
Why it matters
A code generator turns data into code. If it does not escape every special character in that data, text in a spec can become executable text in the output, or in the generator itself. The advisory says the earlier fix handled quotes and similar characters but a limited set of other characters was still not escaped, which made code injection possible.
The class is CWE-94 (Code Injection). The lesson from an incomplete fix is that blocklists are fragile. Escaping that lists the dangerous characters tends to miss one. A safer design encodes the whole value, or builds the output with a structure rather than string concatenation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-25141 exploited in the wild?
The record does not list it on the CISA Known Exploited Vulnerabilities catalog, and the release notes do not report exploitation.
Is the 7.x line fixed as well as 8.x?
Yes. Both lines have a fix: 7.21.0 and 8.2.0.
Sources
Last reviewed: 19 October 2026.
