CVE-2026-62681: Orval OpenAPI Client RCE Vulnerability

CVE-2026-62681 Overview

CVE-2026-62681 is a code injection vulnerability [CWE-94] in Orval, a code generator that produces type-safe JavaScript and TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 emit unescaped backtick characters from OpenAPI paths directly into JavaScript template literals used by generated axios, fetch, react-query, and SWR clients. An attacker who controls an OpenAPI specification can inject JavaScript that executes when the generated request, URL-builder, or query-key function runs. Execution occurs in the developer workstation, continuous integration pipeline, test harness, or application runtime that consumes the generated code.

Critical Impact
Attacker-controlled OpenAPI specifications trigger arbitrary JavaScript execution across developer, CI, test, and production environments through generated client code.

Affected Products

Orval versions prior to 8.21.0
Generated axios, fetch, react-query, and SWR clients produced by vulnerable Orval versions
Downstream applications, CI pipelines, and test environments consuming vulnerable generated code

Discovery Timeline

2026-08-19 - CVE-2026-62681 published to NVD
2026-08-19 - Last updated in NVD database
Fixed in v8.21.0 - Orval maintainers released the patched version with escape logic for spec-controlled strings

Technical Details for CVE-2026-62681

Vulnerability Analysis

Orval generates HTTP client functions by templating OpenAPI path strings into JavaScript backtick-delimited template literals. The route generation logic in packages/core/src/getters/route.ts inserts the raw path value from the specification into the output. When a path contains a backtick character, the generated file terminates the template literal early and treats subsequent characters as JavaScript code. An attacker crafting a malicious OpenAPI document can embed executable payloads inside path definitions. Any consumer running Orval against that specification produces source files containing attacker-controlled expressions.

Root Cause

The root cause is missing output encoding when writing spec-derived strings into JavaScript source. Neither packages/core/src/getters/route.ts nor the object-key generator in packages/core/src/getters/keys.ts applied a JavaScript string literal escape before concatenation. Backticks, dollar-brace sequences, and quote characters flowed through unchanged into template literals and object keys.

Attack Vector

An attacker publishes or supplies a malicious OpenAPI v3 or Swagger v2 specification containing a path such as /users/${process.mainModule.require('child_process').execSync('...')}. When a developer, CI job, or automated tool runs Orval against that spec, the generated client file contains the injected expression. The payload executes the first time the generated function is imported and its template literal is evaluated, giving the attacker code execution in whatever environment consumes the file.

typescript

// Patch: escape spec-controlled strings before emitting them as JS literals
// Source: https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
 import { keyword } from 'esutils';

+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }

The fix routes spec-controlled values through a jsStringLiteralEscape helper and adds jsesc as a dependency to handle JavaScript string escaping consistently across generators.

Detection Methods for CVE-2026-62681

Indicators of Compromise

Generated client files containing backtick, ${, or unescaped quote sequences inside URL template literals
OpenAPI specifications with path values that include backticks, ${...} expressions, or JavaScript keywords
Unexpected child process spawns, outbound network connections, or file writes originating from node, npx orval, or bundler processes during code generation
CI build logs showing Orval executions immediately preceding anomalous shell activity

Detection Strategies

Scan repositories for Orval versions below 8.21.0 in package.json, package-lock.json, yarn.lock, and bun.lock files
Grep generated output directories for suspicious characters (`, ${, require() inside URL template literals produced by Orval
Statically analyze OpenAPI specifications ingested by build pipelines for non-ASCII or non-URL-safe characters in paths keys
Monitor developer and CI hosts for process lineage where node or orval spawns shells, package managers, or network utilities

Monitoring Recommendations

Alert on outbound connections from build agents during Orval execution windows
Track modifications to generated client directories and diff them against expected output
Log and review every OpenAPI specification source URL and integrity hash used by build automation

How to Mitigate CVE-2026-62681

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later across all repositories, developer workstations, and CI environments
Regenerate all client code that was produced by earlier Orval versions and review diffs for injected expressions
Audit OpenAPI specification sources and restrict ingestion to trusted, integrity-verified inputs
Rotate credentials that were accessible from developer or CI environments if malicious specifications were processed

Patch Information

Orval 8.21.0 introduces jsStringLiteralEscape and adds jsesc as a runtime dependency to encode spec-controlled strings before emitting them into template literals and object keys. See the GitHub Security Advisory GHSA-fg9p-mrxr-hvq7, the fix commit, the pull request #3692, and the v8.21.0 release notes.

Workarounds

Pin OpenAPI specification inputs to internally reviewed, version-controlled copies until upgrade is complete
Validate specifications with a linter that rejects backticks, ${, and non-URL characters in paths keys before running Orval
Execute code generation in ephemeral, network-restricted sandboxes to contain any residual injection attempts

bash

# Upgrade Orval to the patched release
npm install --save-dev orval@^8.21.0

# Verify the installed version
npx orval --version

# Regenerate clients from a trusted specification
npx orval --config ./orval.config.ts