Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecifica...
Summary
CVE-2026-62682: When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. Affects orval versions < 8.21.0. Fixed in 8.21.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Summary
When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.
Details
return `http://api.x/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/v1/u`;
Prerequisite: the documented getBaseUrlFromSpecification: true option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server url field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).
PoC
reproduce.sh (+ make_spec.py) attached: generates a fetch client with getBaseUrlFromSpecification: true, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.
Impact
With that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.
Suggested fix
Escape the server URL before emitting it into the URL template literal (escape backtick and ${), or build the base URL with an encoder that treats it as data; validate the URL.
maintainer-report.txt
make_spec.py
reproduce.sh
How To Fix
Latest published version: 8.44.0 as of 22 Oct 2026
npm install orval@8.44.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.21.0
This is the first release that contains the fix.
npm install orval@8.21.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
References
Related vulnerabilities
Recent vulnerabilities recorded for orval.
