{"id":"CVE-2026-62682","aliases":["EUVD-2026-62658","GHSA-88f2-fpv8-89q2","ROOT-APP-NPM-CVE-2026-62682"],"status":"published","title":"Orval: RCE via servers[].url -\u003e unescaped request-URL template literal (with getBaseUrlFromSpecification)","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.","severity":{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00653,"percentile":0.51742,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-1336","CWE-94"],"published":"2026-08-19T17:40:17Z","modified":"2026-10-28T02:31:13Z","fixes":[{"ecosystem":"npm","package":"orval","fixed_in":["8.21.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"orval","fixed_in":["7.21.0-aikido.4","7.21.0-aikido.5","7.21.0-aikido.1","7.13.2-aikido.2","7.13.2-aikido.3","7.21.0-aikido.2","7.21.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/orval","fixed_in":["7.21.0-root.io.4","7.21.0-root.io.5","7.21.0-root.io.1","7.13.2-root.io.2","7.13.2-root.io.3","7.21.0-root.io.2","7.21.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"orval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.21.0"}]}]},{"source":"osv","ecosystem":"npm","package":"orval","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.21.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"orval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-aikido.4"},{"fixed":"7.21.0-aikido.5"},{"fixed":"7.21.0-aikido.1"},{"fixed":"7.13.2-aikido.2"},{"fixed":"7.13.2-aikido.3"},{"fixed":"7.21.0-aikido.2"},{"fixed":"7.21.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/orval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-root.io.4"},{"fixed":"7.21.0-root.io.5"},{"fixed":"7.21.0-root.io.1"},{"fixed":"7.13.2-root.io.2"},{"fixed":"7.13.2-root.io.3"},{"fixed":"7.21.0-root.io.2"},{"fixed":"7.21.0-root.io.3"}]}]}],"products":[{"vendor":"orval-labs","product":"orval"}],"references":[{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/orval-labs/orval/pull/3692","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/orval-labs/orval/releases/tag/v8.21.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62682","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-88f2-fpv8-89q2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62682.json","tags":["advisory"]},{"url":"https://github.com/orval-labs/orval","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-62682","title":"Orval: RCE via servers[].url -\u003e unescaped request-URL template literal (with getBaseUrlFromSpecification)","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.","status":"published","published":"2026-08-19T17:40:17.061Z","modified":"2026-08-19T18:19:27.462Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"}],"cwes":["CWE-94","CWE-116","CWE-1336"],"updated_at":"2026-11-02T14:20:14.665567Z"}],"euvd":[{"id":"EUVD-2026-62658","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.","status":"published","published":"2026-08-19T17:40:17Z","modified":"2026-08-19T18:19:27Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-02T18:01:40.9092Z"}],"ghsa":[{"id":"GHSA-88f2-fpv8-89q2","title":"Orval: RCE via servers[].url -\u003e unescaped request-URL template literal (with getBaseUrlFromSpecification)","description":"### Summary\n\nWhen Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec's `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.\n\n### Details\n\n```ts\nreturn `http://api.x/` + (globalThis.X = require(\"fs\").writeFileSync(\"/marker\",\"pwned\")) + `/v1/u`;\n```\n\nPrerequisite: the documented `getBaseUrlFromSpecification: true` option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server `url` field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates a fetch client with `getBaseUrlFromSpecification: true`, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.\n\n### Impact\n\nWith that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.\n\n### Suggested fix\n\nEscape the server URL before emitting it into the URL template literal (escape backtick and `${`), or build the base URL with an encoder that treats it as data; validate the URL.\n[maintainer-report.txt](https://github.com/user-attachments/files/29396562/maintainer-report.txt)\n[make_spec.py](https://github.com/user-attachments/files/29396563/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29396564/reproduce.sh)","status":"published","published":"2026-09-03T19:06:52Z","modified":"2026-09-03T19:06:53Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-94","CWE-116","CWE-1336"],"updated_at":"2026-11-02T14:41:11.621873Z"}],"nvd":[{"id":"CVE-2026-62682","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.","status":"published","published":"2026-08-19T18:16:54.52Z","modified":"2026-09-09T21:20:38.86Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-94","CWE-116","CWE-1336"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-62682","title":"Orval: RCE via servers[].url -\u003e unescaped request-URL template literal (with getBaseUrlFromSpecification)","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.","status":"published","published":"2026-08-19T17:40:17.061Z","modified":"2026-10-28T02:31:13.313597448Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-116","CWE-1336","CWE-94"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-88f2-fpv8-89q2","title":"Orval: RCE via servers[].url -\u003e unescaped request-URL template literal (with getBaseUrlFromSpecification)","description":"### Summary\n\nWhen Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec's `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.\n\n### Details\n\n```ts\nreturn `http://api.x/` + (globalThis.X = require(\"fs\").writeFileSync(\"/marker\",\"pwned\")) + `/v1/u`;\n```\n\nPrerequisite: the documented `getBaseUrlFromSpecification: true` option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server `url` field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates a fetch client with `getBaseUrlFromSpecification: true`, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.\n\n### Impact\n\nWith that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.\n\n### Suggested fix\n\nEscape the server URL before emitting it into the URL template literal (escape backtick and `${`), or build the base URL with an encoder that treats it as data; validate the URL.\n[maintainer-report.txt](https://github.com/user-attachments/files/29396562/maintainer-report.txt)\n[make_spec.py](https://github.com/user-attachments/files/29396563/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29396564/reproduce.sh)","status":"published","published":"2026-09-03T19:06:52Z","modified":"2026-09-18T05:30:05.787032756Z","cvss":[{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-116","CWE-1336","CWE-94"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"ROOT-APP-NPM-CVE-2026-62682","title":"CVE-2026-62682 in orval - Patched by Root","description":"Root has patched CVE-2026-62682 in the orval package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-21T06:43:17Z","modified":"2026-09-21T07:15:05.643459176Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}