@orval/core vulnerabilities (npm)

2 vulnerabilities.

• @orval/core npm Orval has a code injection via unsanitized x-enum-descriptions uing JS comments CVE-2026-25141 Fix available 9.3 CriticalJanuary 30, 2026
• @orval/core npm Orval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generation CVE-2026-23947 Public exploitFix available 9.3 CriticalJanuary 20, 2026