CVE-2026-62681 in Orval
Summary
by MITRE • 08/19/2026
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The vulnerability identified as CVE-2024-39337 represents a critical security flaw within Orval, an open-source tool designed to generate type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. This issue specifically affects versions prior to 8.21.0 and stems from improper input validation during the code generation process. When Orval processes API definitions containing path parameters or static paths that include unescaped backtick characters, it fails to sanitize these inputs before embedding them into template literals used for HTTP client libraries such as axios, fetch, react-query, and SWR. This oversight creates a direct pathway for server-side code injection within the generated source code files themselves rather than at runtime against a live service.
From a technical perspective, the core of this vulnerability lies in how JavaScript template literals are constructed by the generator. Template literals allow for embedded expressions using backticks as delimiters and dollar signs followed by curly braces for interpolation. If an attacker controls part of the OpenAPI specification path definition and includes a sequence that mimics valid JavaScript syntax within these delimiters, Orval will emit this malicious payload directly into the generated client code without encoding or escaping it properly. Consequently, when any developer imports or executes functions from the generated module, such as request builders or query key generators, the embedded script is interpreted by the JavaScript engine rather than treated as a literal string value for URL construction.
The operational impact of this vulnerability extends beyond simple data leakage and encompasses full remote code execution within the development environment. Since the malicious code is injected into static source files during the build or generation phase, it executes whenever the generated client library is loaded by an application, test suite, or continuous integration pipeline. This allows an attacker who can influence the OpenAPI specification to execute arbitrary JavaScript commands on any machine that processes these specifications and imports the resulting clients. The scope of compromise includes developer workstations where manual code review might be bypassed if automated generation steps are trusted implicitly, as well as CI/CD environments where build artifacts containing the injected payloads could propagate further into deployment pipelines or production systems depending on subsequent processing steps.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection), specifically illustrating how dynamic code generation tools can become vectors for injection attacks if input sanitization is not rigorously applied to template structures. In the context of the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Scripting Interpreter, as it enables the execution of arbitrary scripts within a trusted environment through manipulated configuration inputs. The attack vector primarily involves supply chain compromise or malicious API specification submission, highlighting risks associated with trusting external schema definitions in automated development workflows.
To mitigate this risk, organizations using Orval must immediately upgrade to version 8.21.0 or later, where the issue has been resolved by implementing proper escaping mechanisms for special characters within path segments before they are embedded into template literals. For teams unable to update instantly, manual inspection of generated client files is recommended to identify any anomalous backtick usage that deviates from expected URL patterns. Additionally, adopting strict validation policies on OpenAPI specifications and integrating static analysis tools capable of detecting code injection patterns in generated output can provide additional layers of defense against similar vulnerabilities in other API-first development tooling ecosystems.