CVE-2026-62682: Orval TypeScript Client RCE Vulnerability

CVE-2026-62682 Overview

CVE-2026-62682 is a code injection vulnerability [CWE-94] in Orval, a code generator that produces type-safe TypeScript clients from OpenAPI v3 and Swagger v2 specifications. Versions prior to 8.21.0 fail to escape backtick characters embedded in servers[0].url when output.baseUrl.getBaseUrlFromSpecification is enabled. The unescaped value is emitted directly into generated JavaScript template literals. An attacker who controls the OpenAPI specification can inject arbitrary JavaScript that executes when a generated request or URL-builder function is invoked. Execution occurs in the developer workstation, continuous integration (CI) pipeline, test runner, or downstream application environment. The flaw is located in the getFullRoute function within packages/core/src/getters/route.ts.

Critical Impact
Attacker-controlled OpenAPI specifications execute arbitrary JavaScript in developer, CI, test, and application environments through generated client code.

Affected Products

Orval versions prior to 8.21.0
Projects consuming untrusted OpenAPI v3 or Swagger v2 specifications through Orval
Build pipelines using output.baseUrl.getBaseUrlFromSpecification

Discovery Timeline

2026-08-19 - CVE-2026-62682 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-62682

Vulnerability Analysis

Orval generates request functions by templating specification values into JavaScript template literals. The getFullRoute function in packages/core/src/getters/route.ts reads servers[0].url from an OpenAPI document and inserts it into backtick-delimited strings without encoding. Because template literals in JavaScript support expression interpolation via ${...}, a specification value containing a backtick or ${ sequence terminates the string context and enters an expression context. Any JavaScript placed inside that expression executes when the generated function is called. Consuming a malicious OpenAPI file is therefore sufficient to achieve code execution wherever the generated client runs, including the developer's workstation during codegen, the CI runner during build, test harnesses, and the runtime application.

Root Cause

The root cause is missing output-context escaping in getFullRoute. Specification-controlled strings are treated as safe literals and concatenated into template literal source code. No sanitization is applied for backticks, ${ sequences, or backslash escapes before emission. The upstream fix introduces the jsStringLiteralEscape helper (backed by jsesc) and applies it to spec-controlled strings used in both template literals and generated object keys.

Attack Vector

Exploitation requires that a target project consume an attacker-controlled or attacker-modified OpenAPI specification with Orval. This applies to public API catalogs, third-party spec URLs, forked repositories, and pull requests that update spec files. The attack requires no privileges and no user interaction beyond the standard orval invocation.

typescript

// Patch excerpt: packages/core/src/getters/keys.ts
 import { keyword } from 'esutils';
 
+import { jsStringLiteralEscape } from '../utils';
+
 export function getKey(key: string) {
-  return keyword.isIdentifierNameES5(key) ? key : `'${key}'`;
+  return keyword.isIdentifierNameES5(key)
+    ? key
+    : `'${jsStringLiteralEscape(key)}'`;
 }

Source: Orval commit 8ef1bfd

Detection Methods for CVE-2026-62682

Indicators of Compromise

Generated Orval client files containing unexpected backtick characters, ${ sequences, or JavaScript syntax embedded within URL strings
OpenAPI specification files where servers[0].url contains backticks, ${, or backslash escape sequences
Unexplained outbound network connections or child processes spawned during orval codegen or CI build steps

Detection Strategies

Scan project dependencies for orval versions below 8.21.0 using software composition analysis tooling
Inspect any OpenAPI or Swagger specification consumed by the build for characters that terminate template literal context in servers[].url
Diff generated client output across builds to catch injected JavaScript inserted into URL template strings

Monitoring Recommendations

Monitor CI/CD runners for anomalous process execution, filesystem writes, or network egress during Orval codegen steps
Alert on OpenAPI specification changes in source control that modify servers entries
Log and review the exact Orval version resolved in each build to detect regressions to vulnerable releases

How to Mitigate CVE-2026-62682

Immediate Actions Required

Upgrade Orval to version 8.21.0 or later across all projects and CI pipelines
Audit OpenAPI and Swagger specifications ingested from external sources for malicious servers[].url values
Rebuild and redeploy any client artifacts generated by vulnerable Orval versions from untrusted specs

Patch Information

The fix is available in Orval 8.21.0. The Orval security advisory GHSA-88f2-fpv8-89q2, pull request #3692, and release v8.21.0 notes describe the change. The patch introduces the jsStringLiteralEscape utility (using jsesc) and applies it to specification-controlled strings emitted into template literals and object keys.

Workarounds

Disable output.baseUrl.getBaseUrlFromSpecification and set the base URL from a trusted, non-specification source
Restrict Orval codegen to specifications from vetted, trusted authors and pin them by content hash
Execute codegen inside isolated, ephemeral containers with no secrets or network egress to limit blast radius

bash

# Upgrade to the patched release
npm install --save-dev orval@^8.21.0

# Verify the resolved version
npm ls orval