CVE-2026-62681: Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (`/users/...`) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval’s default OpenAPI validation.
References
- github.com/advisories/GHSA-fg9p-mrxr-hvq7
- github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
- github.com/orval-labs/orval/pull/3692
- github.com/orval-labs/orval/releases/tag/v8.21.0
- github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7
- nvd.nist.gov/vuln/detail/CVE-2026-62681
Code Behaviors & Features
Detect and mitigate CVE-2026-62681 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →