Orval RCE: Backtick Injection in Generated OpenAPI Request URLs (CVE-2026-62681)

What happened

A GitHub Security Advisory (GHSA-fg9p-mrxr-hvq7, CVE-2026-62681) reports that Orval, a popular tool for generating TypeScript API clients from OpenAPI specs, emits the OpenAPI path directly into a generated request URL as a JavaScript template literal without escaping backtick characters. A path value containing a backtick can close the template literal early and inject a live expression (e.g. + (require("fs").writeFileSync(...)) + ) that executes when the generated request function, URL builder, or query-key function is called. The researcher reports this affects Orval's axios, fetch, react-query, and swr client outputs, and verified it against Orval 8.19.0 with a proof-of-concept that survives Orval's default OpenAPI validation. The advisory notes this is a distinct root cause from Orval's four prior published CVEs, which involved different fields (summary, x-enumDescriptions, const) and different sinks.

Why it matters

This is a code-generation supply-chain issue rather than a runtime web vulnerability: the payload lives in the OpenAPI specification itself. Any workflow that generates an Orval client from an OpenAPI/Swagger document that is attacker-controlled or attacker-influenced — a third-party API description, a spec pulled from an external service, a spec accepted via a PR or CI pipeline — can result in arbitrary code execution wherever that generated client is later invoked: a developer's machine, a CI runner, or the running application itself. Teams that treat OpenAPI specs as inert configuration data rather than untrusted input are exposed.

What defenders should watch for now

• Inventory where OpenAPI/Swagger specs used to drive Orval (or similar codegen tools) originate — internal-only vs. third-party or externally submitted specs.
• Treat any externally sourced OpenAPI spec as untrusted input; review or sanitize path fields (and other string fields) before running codegen against them, especially for backtick, ${, or other template-literal metacharacters.
• Audit generated client code for unexpected expressions embedded in URL-building template literals rather than assuming generated code is inert.
• In CI, review diffs of generated client files when the source spec changes, and consider running codegen steps in a sandboxed/isolated environment given the demonstrated file-write PoC.
• Watch Orval's release notes and the GHSA advisory for a patched version that escapes path values before emission, and upgrade once available.

Developing intel

This is a same-day, newly published advisory with a public PoC and no confirmed patched Orval version referenced in the report as of this writing; details may evolve. For the full technical writeup and PoC, see the original advisory: GHSA-fg9p-mrxr-hvq7.