CVE-2026-62682

Executive Summary

CVE-2026-62682 is a code injection vulnerability in Orval, a widely used tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to version 8.21.0, Orval improperly emits unescaped backticks found in servers[0].url into generated request URL template literals, allowing attacker-controlled JavaScript to be evaluated at runtime when a generated request or URL-builder function is invoked. The impact is arbitrary code execution in any environment where generated client code is executed — including developer machines, CI/CD pipelines, test harnesses, and production application runtimes.

Technical Analysis

Vulnerability Mechanism

The root cause of CVE-2026-62682 lies in Orval's code generation pipeline, specifically within the packages/core/src/getters/route.ts function named getFullRoute. This function is responsible for constructing the full request URL during client generation by combining the base URL derived from the OpenAPI specification with endpoint paths.

When Orval processes an OpenAPI v3 or Swagger v2 specification, it reads the servers[0].url field (the first entry in the servers array) as the base URL for all generated requests. This value is inserted into a template literal in the generated TypeScript/JavaScript code. The critical flaw is that this value is not properly sanitized or escaped when it contains a backtick character (`).

In JavaScript, template literals are delimited by backticks. If an unescaped backtick appears within a template literal being constructed during code generation, it can terminate the template literal prematurely and inject arbitrary JavaScript syntax into the generated code. Because Orval is generating source code programmatically, any attacker-controlled content placed into servers[0].url can break out of the intended string context and inject executable code into the generated client.

Technical Impact Chain

1. Input Vector: An attacker crafts a malicious OpenAPI/Swagger specification where servers[0].url contains a backtick followed by arbitrary JavaScript code. For example, a URL value crafted to close an open template literal, execute a payload, and then reopen a new template literal to preserve syntax validity.

2. Code Generation: A developer or CI pipeline runs Orval against the malicious specification with output.baseUrl.getBaseUrlFromSpecification enabled (which is the setting that triggers the vulnerable code path). Orval reads the malicious servers[0].url and writes it into the generated request code — specifically into the request URL template literal constructed by getFullRoute.

3. Injection Point: The generated code contains a template literal such as const url = \${baseUrl}${path}`. The attacker-controlled backtick in baseUrl` terminates the literal and allows arbitrary JavaScript to be injected into the generated file.

4. Trigger: When the generated request or URL-builder function is called at runtime — in a developer's local test, in a CI pipeline executing tests, or in a production application — the injected JavaScript executes with the privileges of the calling process.

Attack Surface

The attack surface includes:

• Developer workstations: Developers who generate clients from OpenAPI specs received via email, downloaded from public repositories, pull requests, or package registries.
• CI/CD pipelines: Automated build pipelines that regenerate clients from specifications stored in repositories or fetched from external URLs.
• Applications using generated clients: Production services that embed the generated client code and execute requests at runtime.
• Supply chain: OpenAPI specifications are often shared and reused across teams and organizations, making this a viable supply-chain attack vector.

Exploitation Scenarios

Scenario 1: Malicious OpenAPI Specification in a Public Repository

Step 1 — Reconnaissance/Target Identification: An attacker identifies open-source projects that use Orval to generate API clients, particularly those that fetch OpenAPI specifications from external URLs or accept community contributions to specification files (e.g., via pull requests).

Step 2 — Flaw Trigger: The attacker submits a pull request or update to an openapi.yaml/swagger.json file that includes servers[0].url containing an injected payload such as:

https://api.example.com/`; process.env.PAYLOAD=1; // 

When a maintainer merges this and runs the Orval generation command, the backtick terminates the template literal and the payload becomes part of the generated code.

Step 3 — Execution Method: The payload executes when a generated request function is called — either during automated tests run by CI (often immediately after merge), or when a developer runs the client locally. The injected JavaScript runs in the context of the CI agent or developer machine.

Step 4 — Post-Exploitation Impact: The attacker achieves arbitrary code execution in the CI/CD environment, potentially exfiltrating secrets, modifying build artifacts, or propagating malicious code to downstream users of the generated package.

Scenario 2: Malicious OpenAPI Document in a Private Codebase

Step 1 — Reconnaissance: An attacker compromises a server or repository that hosts an OpenAPI specification consumed internally by a development team using Orval.

Step 2 — Flaw Trigger: The attacker modifies the hosted specification to include a crafted servers[0].url. The next time a developer generates a client, the malicious payload is embedded.

Step 3 — Execution Method: The application environment where the generated client is deployed executes the injected code when making an API request.

Step 4 — Post-Exploitation Impact: Depending on the application privileges, the attacker could achieve full remote code execution in the application runtime, access internal services, or pivot within the network.

Exploitation Constraints

No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class (code injection via unsafe code generation). The attack requires:

• An attacker capable of influencing the content of an OpenAPI/Swagger specification that gets processed by Orval.
• The output.baseUrl.getBaseUrlFromSpecification feature must be enabled.
• The generated code must be executed for the payload to trigger.

Impact Assessment

Business Impact

CVE-2026-62682 presents a critical supply-chain risk because the vulnerable component is a code generator used in development workflows. If exploited, an attacker achieves code execution in the following contexts:

1. Developer machines: Compromise of local development environments, including access to source code, credentials, SSH keys, and other sensitive data.
2. CI/CD systems: High-value targets where attackers can compromise build pipelines, inject backdoors into build artifacts, and poison the software supply chain — impacting every downstream consumer of the generated package.
3. Production applications: Runtime code execution in application environments, enabling data exfiltration, lateral movement, and service disruption.

Affected Systems

All Orval users on versions prior to 8.21.0 who:

• Use output.baseUrl.getBaseUrlFromSpecification.
• Process untrusted OpenAPI or Swagger specifications from any source.
• Run generated code in any environment.

CVSS Assessment

Even though no official CVSS has been assigned, based on the vulnerability class (CWE-94 Code Injection), a reasonable assessment reflects:

• Attack Vector: Network (AV:N) — a malicious spec can be delivered remotely.
• Attack Complexity: Low (AC:L) — crafting a malicious spec is trivial once the flaw is known.
• Privileges Required: None (PR:N) — no pre-existing access required.
• User Interaction: Required (UI:R) — a developer must run Orval on the malicious spec.
• Scope: Changed (S:C) — the injection occurs in a code generation tool and impacts the environment where generated code executes.
• Confidentiality/Integrity/Availability Impact: High (C:H/I:H/A:H) — full code execution.

Blast Radius

High. The generated clients are often committed to repositories and distributed as npm packages. A single malicious specification could compromise multiple downstream consumers, making this vulnerability a viable vector for widespread supply-chain attacks.

Detection Guidance

Sigma Rule

title: Orval Code Injection via Malicious OpenAPI Spec
id: 8f8e4d2e-4a11-4f0c-9b7e-7a6f1d9c3b21
status: experimental
description: Detects Orval generation from untrusted specs or presence of encoded backtick injection patterns in spec files
author: Security Analyst
date: 2026/01/01
tags:
  - attack.execution
  - attack.t1203
  - cve.2026.62682
logsource:
  category: process_creation
  product: windows
detection:
  selection_orval:
    Image|endswith:
      - '\orval.exe'
      - '\orval'
    CommandLine|contains:
      - 'generate'
      - 'openapi'
      - 'swagger'
  selection_url_injection:
    CommandLine|contains:
      - 'servers[0].url'
      - 'baseUrl'
      - 'getBaseUrlFromSpecification'
  condition: selection_orval and selection_url_injection
level: high
falsepositives:
  - Legitimate use of Orval with valid specs

YARA Rule

rule Orval_Backtick_Injection_CVE_2026_62682 {
    meta:
        description = "Detects backtick injection patterns in OpenAPI/Orval generated code"
        author = "Security Research"
        date = "2026-01-01"
        reference = "CVE-2026-62682"
        severity = "critical"
    strings:
        $a = /servers[^}]{0,200}url[^}]{0,500}`.{0,500}``/ nocase
        $b = "getBaseUrlFromSpecification" ascii
        $c = "getFullRoute" ascii
        $d = "packages/core/src/getters/route" ascii
        $e = /`\;\s*(const|let|var|function|process|require)\s/ ascii
        $f = /\{\$\{`/ ascii
    condition:
        (uint16(0) == 0x4D5A or filesize < 100KB) and
        (1 of ($a, $e, $f)) and
        (any of ($b, $c, $d))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-62682 Orval OpenAPI Backtick Injection Attempt"; flow:to_server,established; content:"servers"; http_uri; nocase; content:"url"; http_uri; nocase; content:"`"; http_uri; pcre:"/[`][^`]{1,100}(const|let|var|process|require|function)[^`]{1,100}[`]/si"; classtype:attempted-user; sid:202662682; rev:1;)

Elastic Detection

process where event.action == "exec" and process.name in ("orval", "node", "npm") and process.args == "generate" and process.command_line like "*openapi*" and process.command_line like "*swagger*" and process.command_line like "*servers[0].url*"

// Correlation: Monitor file writes containing injection patterns
// fire$file : file where event.action == "creation" and file.extension in ("ts", "js") and file.path like "*api*" and file.path like "*client*" and file.text like "*`;*" and (file.text like "*process.env*" or file.text like "*require*" or file.text like "*eval*")

Splunk SPL Query

index=process OR index=sysmon EventCode=1 
  | where (Image LIKE "*orval*" OR CommandLine LIKE "*orval*") 
    AND (CommandLine LIKE "*generate*" OR CommandLine LIKE "*openapi*" OR CommandLine LIKE "*swagger*")
  | table _time, host, user, Image, CommandLine
  | append [search index=files sourcetype=file_monitoring 
      (file_path LIKE "*generated*" OR file_path LIKE "*client*") 
      AND (content LIKE "*`;*process*" OR content LIKE "*`;*require*" OR content LIKE "*eval(*")
    | table _time, host, file_path, content]
  | sort - _time

Wazuh OSSEC Rule

<group name="local,attacks,">
  <!-- Orval Code Injection CVE-2026-62682 -->
  <rule id="100626" level="10">
    <decoded_as>json</decoded_as>
    <field name="command" type="pcre2">\borval\b.*\bgenerate\b</field>
    <description>Orval generation process detected - potential CVE-2026-62682 exploitation vector</description>
    <mitre>
      <id>T1203</id>
      <ref>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62682</ref>
    </mitre>
    <group>orval,code_generation,supply_chain,</group>
  </rule>

  <!-- Detection of backtick injection payloads in spec files -->
  <rule id="100627" level="15">
    <decoded_as>json</decoded_as>
    <field name="file" type="pcre2">\.(json|yaml|yml)$</field>
    <field name="content" type="pcre2">servers:\s*-\s*url:\s*["'][^"']*`[^"']*</field>
    <description>Suspicious backtick found in OpenAPI servers URL - potential CVE-2026-62682 payload</description>
    <mitre>
      <id>T1203</id>
      <ref>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-62682</ref>
    </mitre>
    <group>orval,code_generation,supply_chain,cwe-94,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source.

1) Immediate Mitigations

The following measures should be applied to reduce exposure while no confirmed patch is available:

• Disable output.baseUrl.getBaseUrlFromSpecification: If the feature is not strictly required, disable it in the Orval configuration to avoid the vulnerable code path entirely. This is the most direct mitigation.
• Treat OpenAPI/Swagger specifications as untrusted input: Impose strict access controls on specification files. Do not accept specs from untrusted sources, including third-party pull requests, unverified public repositories, or unauthenticated URLs in CI.
• Run Orval in isolated sandbox: Execute Orval in a Docker container or VM with minimal privileges, no network access to internal systems, and no access to production credentials. This contains the blast radius of any code injection.
• Review generated code: Implement a manual or automated code review step that scans generated client code for unexpected backtick characters, template literal injection patterns, or additional code appended to the URL construction functions.

2) Patch/Upgrade Steps

• Upgrade to Orval 8.21.0 or later when verifying the patch is available from the official distribution channel. The NVD description states the issue is fixed in version 8.21.0.
• After upgrading, regenerate all clients from spec files to ensure any previously injected malicious code is removed from generated artifacts.
• Audit existing generated code: Examine all previously generated client code for signs of injection, particularly in request URL construction functions, and regenerate from a trusted spec if any anomalies are found.

3) Long-Term Hardening

• Pin dependency versions: Use exact version pinning for Orval in package.json or equivalent lock files and establish a vulnerability-scanning process that flags outdated versions.
• Validate spec content: Implement schema validation that rejects spec files containing suspicious characters (backticks) in server URLs or other code-generation-relevant fields.
• Subresource Integrity (SRI) / checksum validation: Where feasible, validate the integrity of downloaded spec files against known checksums.
• Security training: Educate developers on the risks of processing untrusted data through code generators and the importance of treating generated code from untrusted specs as potentially malicious.
• Monitor security advisories: Subscribe to Orval's GitHub repository and npm advisory feed to receive timely updates about this and future vulnerabilities.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-62682
2. Orval GitHub Repository: https://github.com/orval-labs/orval
3. Orval npm Package: https://www.npmjs.com/package/orval
4. NVD CWE-94 Reference: https://cwe.mitre.org/data/definitions/94.html — Code Injection
5. MITRE ATT&CK Technique T1203: https://attack.mitre.org/techniques/T1203/ — Exploitation for Client Execution

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No known exploitation in the wild has been reported at the time of this writing. No CISA KEV listing exists. The vendor fix is referenced as version 8.21.0 in the NVD description; users are strongly advised to verify upgrade availability through official channels. The lack of a confirmed patch in tracked sources (patch confidence 0/4) means affected users should remain vigilant and apply the defensive mitigations above.