CVE-2026-62682

Orval, an npm code generator that produces API clients from OpenAPI specifications, embeds the spec's servers[0].url into the generated request-URL template literal without escaping when output.baseUrl.getBaseUrlFromSpecification is set to true. A server URL containing a backtick (or template syntax) breaks out of the template literal and injects an arbitrary JavaScript expression that is evaluated at runtime whenever the generated request function is called, and the flaw survives Orval's default OpenAPI validation; it was verified on Orval 8.19.0 with the fetch client. An attacker who controls or influences the OpenAPI document (e.g., a third-party or imported spec) therefore gains arbitrary code execution in any process that invokes the generated client, with high confidentiality, integrity, and availability impact per the CVSS 4.0 score of 9.3 (critical). Affected users are teams running Orval with the getBaseUrlFromSpecification option enabled, both in build environments and in the downstream applications whose generated clients call the injected code. No public exploit or in-the-wild exploitation is known; it is not in CISA KEV and EPSS estimates only a ~0.5% probability of exploitation within 30 days (41st percentile).

What to do: Until a patched Orval release is available, avoid setting output.baseUrl.getBaseUrlFromSpecification to true (hard-code the base URL instead) or sanitize the OpenAPI servers[].url by stripping backticks and ${ sequences before running the generator. Audit already-generated clients for unescaped backtick-derived template literals originating from server URLs, and treat externally sourced OpenAPI documents as untrusted input. Monitor the Orval project for a fix that escapes backticks and ${ in emitted URL template literals, and upgrade when published.