CVE-2026-62681

UNKNOWN 0.0

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.

CWE	CWE-94 CWE-116 CWE-1336
Vendor	orval-labs
Product	orval
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for orval-labs orval

Be the first to know when new unknown vulnerabilities affecting orval-labs orval are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

orval-labs / orval

< 8.21.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7 github.com: https://github.com/orval-labs/orval/pull/3692 github.com: https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6 github.com: https://github.com/orval-labs/orval/releases/tag/v8.21.0