@orval/core (npm) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the npm package @orval/core, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (2)

• CVE-2026-23947 — CVSS 9.8 (critical): Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until…
• CVE-2026-25141 — CVSS 9.8 (critical): Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and…