Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ('), double quotes (") and so on, it is still possible to achieve code injection using only a limited set of characters that are currently not escaped. The vulnerability lies in the fact that the application can be forced to execute arbitrary JavaScript using characters such as []()!+. By using a technique known as JSFuck, an attacker can bypass the current sanitization logic and run arbitrary code without needing any alphanumeric characters or quotes. Version 7.21.0 and 8.2.0 contain an updated fix.
Priority
MEDIUM
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-01-30 | 2 | Disclosure1Patch1 |
| 2026-02-04 | 1 | Disclosure1 |
| 2026-03-11 | 1 | Disclosure1 |
#VulnerabilityReport #codeinjection Poisoned Comments: Critical Orval Flaw (CVE-2026-25141) Injects Code https://securityonline.info/poisoned-comments-critical-orval-flaw-cve-2026-25141-injects-code/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet announces the discovery of a code‑injection vulnerability, CVE‑2026‑25141, and provides a link for further details.
Poisoned Comments: Critical Orval Flaw (CVE-2026-25141) Injects Code https://securityonline.info/poisoned-comments-critical-orval-flaw-cve-2026-25141-injects-code/
Post summary
The text announces a new critical vulnerability (CVE-2026-25141) in Orval that permits code injection via comments, linking to a detailed post, but it does not provide exploit code, patches, or evidence of active exploitation.
CVE-2026-25141 Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 h… https://www.cve.org/CVERecord?id=CVE-2026-25141
Post summary
The notice announces CVE-2026-25141 as affecting specific Orval releases, providing affected version ranges but no exploitation or mitigation details.
🚨 CVE-2026-25141: Orval has a code injection via u... JSFuck-based code injection in Orval bypasses sanitization with []()!+ chars - patch now or watch your API clients beco... https://zerodaysignal.com/vulnerability/CVE-2026-25141 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The tweet announces a code injection vulnerability in Orval, details the JSFuck-based exploitation method, and urges users to apply a patch to protect their API clients.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | orval | orval | - | - | - |