CVE-2026-62682: Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec’s servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.
References
- github.com/advisories/GHSA-88f2-fpv8-89q2
- github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
- github.com/orval-labs/orval/pull/3692
- github.com/orval-labs/orval/releases/tag/v8.21.0
- github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2
- nvd.nist.gov/vuln/detail/CVE-2026-62682
Code Behaviors & Features
Detect and mitigate CVE-2026-62682 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →