PatchSiren cyber security CVE debrief
CVE-2026-62681 orval-labs CVE debrief
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T18:16:54.383Z and has not been modified since then. The NVD entry is currently Received. Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0. Developers and users of Orval-generated clients, especially those using axios, fetch, react-query, and SWR clients, should be aware of this critical vulnerability and take steps to mitigate it by updating to version 8.21.0 or later. The CVE record and NVD entry provide details on the vulnerability in Orval, a tool for generating type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. The vulnerability allows for code execution due to an unescaped backtick in OpenAPI paths being emitted into request URL template literals without safe encoding.
- Vendor
- orval-labs
- Product
- orval
- CVSS
- CRITICAL 9.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-19
- Original CVE updated
- 2026-08-21
- Advisory published
- 2026-08-19
- Advisory updated
- 2026-08-21
Who should care
Developers and users of Orval-generated clients, especially those using axios, fetch, react-query, and SWR clients, should be aware of this critical vulnerability and take steps to mitigate it by updating to version 8.21.0 or later.
Technical summary
The Orval tool generates type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. Prior to version 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is in packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.
Defensive priority
Developers and users of Orval-generated clients should prioritize updating to version 8.21.0 or later to mitigate this critical vulnerability.
Recommended defensive actions
- Update Orval to version 8.21.0 or later
- Review and update affected code in packages/core/src/getters/route.ts and route generation consumers
- Implement safe encoding for request URL template literals
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review compensating controls for exposed systems while remediation is scheduled and verified.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
- Track exceptions, retest remediated assets, and close the item only after evidence is documented.
Evidence notes
The CVE record and NVD entry provide details on the vulnerability in Orval, a tool for generating type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. The vulnerability allows for code execution due to an unescaped backtick in OpenAPI paths being emitted into request URL template literals without safe encoding.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-19T18:16:54.383Z and has not been modified since then.