CVE-2026-62682: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
Summary
When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.
Details
ts return http://api.x/ + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + /v1/u;
Prerequisite: the documented getBaseUrlFromSpecification: true option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server url field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).
PoC
reproduce.sh (+ makespec.py) attached: generates a fetch client with getBaseUrlFromSpecification: true, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.
Impact
With that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.
Suggested fix
Escape the server URL before emitting it into the URL template literal (escape backtick and ${), or build the base URL with an encoder that treats it as data; validate the URL. maintainer-report.txt makespec.py reproduce.sh
Other sources
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.21.0 - Upgrade
Upgrade
Orvalto a version that resolves this vulnerability.Fixed in 8.21.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of npm/orval versions prior to 8.21.0 are exposed if they generate clients from an OpenAPI v3 or Swagger v2 specification whose servers[0].url is attacker-controlled or otherwise untrusted, and output.baseUrl.getBaseUrlFromSpecification is enabled.
What must occur for code execution to happen?
A specification must contain an unescaped backtick in servers[0].url, and Orval must generate code with the affected base-URL option enabled. The injected JavaScript is evaluated when a generated request function or URL-builder function is called.
Are default Orval configurations affected?
The issue is specifically tied to configurations with output.baseUrl.getBaseUrlFromSpecification enabled. The provided information does not indicate that configurations without this option are affected.
What should teams do if they cannot immediately upgrade?
Avoid generating clients from untrusted specifications and disable output.baseUrl.getBaseUrlFromSpecification where possible. Treat specifications containing backticks in servers[0].url as unsafe until upgrading to version 8.21.0.
How can teams identify potentially affected generated clients?
Review generation inputs for backticks in servers[0].url and review Orval configuration for output.baseUrl.getBaseUrlFromSpecification being enabled. Generated clients are at risk when both conditions were present in a version prior to 8.21.0.