@orval/core

Latest 8.41.0

NPM

82%

Total Score

healthy

Strong maintenance and release activity, with workflow security and reproducibility gaps lowering confidence.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All seven workflows were analyzed, but all 23 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and trusted-publishing findings add workflow hygiene concerns, although no untrusted checkout or script-injection sink was observed.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-147639 @orval/core is vulnerable to Code Injection in versions 8.23.0 - 8.29.0.	8.23.0 - 8.29.0	High
AIKIDO-2026-162094 @orval/core is vulnerable to Code Injection in versions 6.11.0 - 8.28.1.	6.11.0 - 8.28.1	High
AIKIDO-2026-929342 @orval/core is vulnerable to Code Injection in versions 8.0.0 - 8.28.1.	8.0.0 - 8.28.1	Critical
CVE-2026-25141 @orval/core is vulnerable to Improper Neutralization of Encoded URI Schemes in a Web Page in versions 7.19.0 - 7.21.0 and 8.0.0 - 8.2.0.	7.19.0 - 7.21.08.0.0 - 8.2.0	Critical
CVE-2026-23947 @orval/core is vulnerable to Improper Neutralization of Special Elements used in a Command ('Command Injection') in versions 8.0.0-rc.0 - 8.0.2 and 0.0.0 - 7.19.0.	0.0.0 - 7.19.08.0.0-rc.0 - 8.0.2	Critical