@orval/core

Latest 8.43.0

87%

Total Score

healthy

Frequent releases, active contributors, and release notes outweigh workflow hygiene issues and an indirect package-to-repository link.

Are you affected? Scan for Free

Health Score Breakdown

Repo package mention

The repository name does not match @orval/core and its README does not mention the package, creating some uncertainty about the exact package-to-source relationship. The mismatch is compatible with a monorepo subpackage, so this is only a caution.

Workflow audit

The audit analyzed all seven workflows, but all 23 action references are unpinned, four workflows grant top-level write permissions, and high-confidence template-injection findings remain. The template-injection paths do not coincide with the repository's workflow_run trigger, limiting the severity, but trusted-publishing findings still warrant caution.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-147639 @orval/core is vulnerable to Code Injection in versions 8.23.0 - 8.29.0.	8.23.0 - 8.29.0	High
AIKIDO-2026-162094 @orval/core is vulnerable to Code Injection in versions 6.11.0 - 8.28.1.	6.11.0 - 8.28.1	High
AIKIDO-2026-929342 @orval/core is vulnerable to Code Injection in versions 8.0.0 - 8.28.1.	8.0.0 - 8.28.1	Critical
CVE-2026-25141 @orval/core is vulnerable to Improper Neutralization of Encoded URI Schemes in a Web Page in versions 7.19.0 - 7.21.0 and 8.0.0 - 8.2.0.	7.19.0 - 7.21.08.0.0 - 8.2.0	Critical
CVE-2026-23947 @orval/core is vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') in versions 8.0.0-rc.0 - 8.0.2 and 0.0.0 - 7.19.0.	0.0.0 - 7.19.08.0.0-rc.0 - 8.0.2	Critical