CVE-2026-62682 orval-labs CVE debrief

Who should care

Developers, CI/CD teams, and security professionals responsible for maintaining and securing applications that use Orval-generated JavaScript clients should assess their exposure and apply the fix.

Why it matters

CVE-2026-62682 is a critical vulnerability in Orval that allows for code execution in environments where Orval-generated clients are used. Immediate attention is required to assess exposure and apply the fix.

• Code execution in developer, CI, test, or application environments.
• Potential for attacker-controlled JavaScript evaluation.
• Need for immediate assessment and remediation.

Technical summary

The vulnerability in Orval arises from an unescaped backtick in servers[0].url being emitted into request URL template literals. This allows attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is in packages/core/src/getters/route.ts function getFullRoute. The issue is fixed in version 8.21.0.

Defensive priority

Immediate attention is required to assess exposure and apply the fix, as code execution is possible in environments where Orval-generated clients are used.

Recommended defensive actions

• Assess exposure by identifying environments where Orval-generated clients are used.
• Verify if the fix in version 8.21.0 has been applied.
• Review and update affected versions, if any.
• Monitor for potential exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fix. However, additional information on affected versions, exploitation, and victim impact is limited. Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.