CVE-2026-23947

{"id": "CVE-2026-23947", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23947", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T17:04:30.700710Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "orval-labs", "product": "orval", "versions": [{"status": "affected", "version": ">= 8.0.0-rc.0, < 8.0.2"}, {"status": "affected", "version": "< 7.19.0"}]}]}], "published": "2026-01-20T01:15:57.583", "references": [{"url": "https://github.com/orval-labs/orval/releases/tag/v8.0.2", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/orval-labs/orval/security/advisories/GHSA-h526-wf6g-67jv", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-77"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated clients via the x-enumDescriptions field, which is embedded without proper escaping in getEnumImplementation(). I have confirmed that the injection occurs during const enum generation and results in executable code within the generated schema files. Orval 7.19.0 and 8.0.2 contain a fix for the issue."}, {"lang": "es", "value": "Orval genera clientes JS con seguridad de tipos (TypeScript) a partir de cualquier especificaci\u00f3n OpenAPI v3 o Swagger v2 v\u00e1lida. Las versiones anteriores a la 7.19.0 hasta la 8.0.2 son vulnerables a la ejecuci\u00f3n de c\u00f3digo arbitrario en entornos que consumen clientes generados. Este problema es similar en naturaleza a CVE-2026-22785, pero afecta a una ruta de c\u00f3digo diferente en @orval/core que no fue abordada por la correcci\u00f3n de CVE-2026-22785. La vulnerabilidad permite a especificaciones OpenAPI no confiables inyectar c\u00f3digo TypeScript/JavaScript arbitrario en clientes generados a trav\u00e9s del campo x-enumDescriptions, el cual se incrusta sin el escape adecuado en getEnumImplementation(). He confirmado que la inyecci\u00f3n ocurre durante la generaci\u00f3n de enumeraciones constantes y resulta en c\u00f3digo ejecutable dentro de los archivos de esquema generados. Orval 7.19.0 y 8.0.2 contienen una correcci\u00f3n para el problema."}], "lastModified": "2026-06-17T10:22:19.970", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AAE568E-4A06-4EFF-8618-458703194D4F", "versionEndExcluding": "7.19.0"}, {"criteria": "cpe:2.3:a:orval:orval:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "37F5479C-90CE-43A1-A3F9-5FC8AA7BDBBD", "versionEndExcluding": "8.0.2", "versionStartIncluding": "8.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}