CVE-2026-62682: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Configuration
If you have output.baseUrl.getBaseUrlFromSpecification enabled in Orval versions prior to 8.21.0, disable it or ensure safe encoding is used, because unescaped backticks in servers[0].url are emitted into request URL template literals generated by getBaseUrlFromSpecification (affected code: packages/core/src/getters/route.ts getFullRoute).
Orval output.baseUrl.getBaseUrlFromSpecification enabled = true/without safe encoding
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of npm/orval versions prior to 8.21.0 are exposed if they generate clients from an OpenAPI v3 or Swagger v2 specification whose servers[0].url is attacker-controlled or otherwise untrusted, and output.baseUrl.getBaseUrlFromSpecification is enabled.
What must occur for code execution to happen?
A specification must contain an unescaped backtick in servers[0].url, and Orval must generate code with the affected base-URL option enabled. The injected JavaScript is evaluated when a generated request function or URL-builder function is called.
Are default Orval configurations affected?
The issue is specifically tied to configurations with output.baseUrl.getBaseUrlFromSpecification enabled. The provided information does not indicate that configurations without this option are affected.
What should teams do if they cannot immediately upgrade?
Avoid generating clients from untrusted specifications and disable output.baseUrl.getBaseUrlFromSpecification where possible. Treat specifications containing backticks in servers[0].url as unsafe until upgrading to version 8.21.0.
How can teams identify potentially affected generated clients?
Review generation inputs for backticks in servers[0].url and review Orval configuration for output.baseUrl.getBaseUrlFromSpecification being enabled. Generated clients are at risk when both conditions were present in a version prior to 8.21.0.