# Orval has Code Injection via unsanitized x-enum-descriptions using JS comments

Orval's jsStringEscape fails to sanitize */ in x-enumDescriptions, letting a malicious OpenAPI spec break out of a JS comment and inject code into generated files.

- Payout: Research
- Severity: critical
- Program: Orval
- Found by: progfay, k14uz
- Disclosed: 2026-01-30
- CVE: CVE-2026-25141
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-gch2-phqh-fg9q
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-gch2-phqh-fg9q
- Tags: area:oss domain:oss impact:rce kind:research platform:ghsa sev:critical tech:nodejs technique:incomplete-fix technique:source-review vuln:rce

**Target:** OpenAPI code generator (@orval/core) emitting JS/TS from spec fields
**Root cause:** jsStringEscape escapes quotes and other chars but not * and /, so a */ sequence in x-enumDescriptions terminates the generated JS comment block and the remainder is parsed as code.
**Steps:**
1. Craft an OpenAPI 3.0.4 spec with a schema EvilEnum whose x-enumDescriptions entry begins with `pwned */ };` followed by attacker JS and ends with `const a = { /*` to re-open a comment.
2. Run Orval codegen against the spec so it emits the enum description inside a JS comment.
3. The `*/` closes the comment; injected payload executes when the generated file is imported/run (PoC uses `import('child_process')` / `cp.execSync('touch pwned')`).
**How found:** Follow-up on incomplete fix for CVE-2026-23947 (GHSA-h526-wf6g-67jv): reviewing jsStringEscape showed it handles quotes but not `*`/`/`, enabling comment-block breakout.
**Exploitation:** Supply-chain style: attacker controls an OpenAPI spec consumed by a victim's Orval build; injected code runs in the generated client, achieving code execution in the build/runtime context (PoC touches a file via child_process).
**Insight:** When a sanitizer was patched for one injection context (string literals), re-audit the same sink for the other context it feeds — here JS comment blocks, where `*/` is the escape hatch, not quotes.