CVE-2026-62681

Orval, an npm tool that generates TypeScript API clients (axios, fetch, react-query, and swr) from OpenAPI descriptions, inserts the OpenAPI route path directly into generated request-URL template literals without escaping. If the path in the OpenAPI document contains a backtick, it terminates the template literal and injects a JavaScript expression that is evaluated whenever the generated request function, URL builder, or query-key function is called, giving the attacker arbitrary code execution. An attacker who controls or can influence the API specification — for example a third-party API's published OpenAPI file consumed by a team's build, CI pipeline, or application — gains code execution on developer machines, CI runners, or in the running application's environment. Users of Orval (vulnerability verified on 8.19.0; full affected version range not specified in available data) are affected, and this flaw is distinct from Orval's four previously published CVEs, which cover different fields and sinks not addressed by those fixes. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing is known; EPSS estimates a 0.5% probability of exploitation within 30 days.

What to do: Audit generated Orval clients (axios, fetch, react-query, swr) for URL template literals containing unescaped backticks or injected expressions, especially where OpenAPI documents originate from third parties, and treat generated output as untrusted code in builds and bundles until patched. As a mitigation, escape or restrict path characters (backtick and ${) in OpenAPI documents before generation. Apply the upstream fix when a patched Orval release is published — no fixed version is confirmed in the available data — and note that the fixes for Orval's earlier CVE-2026-22785, CVE-2026-23947, CVE-2026-25141, and CVE-2026-24132 do not cover this path-based sink.