Orval Advisory: RCE via Unescaped `servers[].url` in Generated Client Base URLs (CVE-2026-62682)

A newly published GitHub Security Advisory (GHSA-88f2-fpv8-89q2, CVE-2026-62682) reports a code-execution flaw in Orval, the popular npm code-generation tool that builds TypeScript API clients from OpenAPI specifications.

What was reported

According to the maintainer-published advisory, when Orval's output.baseUrl.getBaseUrlFromSpecification: true option is enabled, Orval takes the servers[0].url value straight out of the OpenAPI spec and embeds it into the generated request-URL as a JavaScript template literal — without escaping backticks. A server URL containing a backtick can close the template literal and inject an arbitrary JavaScript expression, which then executes when the generated client function is called. The report states this was verified against Orval 8.19.0 with the fetch client, and that it survives default OpenAPI validation. A working PoC (spec generator plus reproduction script) is attached to the advisory. The report notes this is a distinct sink from Orval's previously disclosed CVEs (which involved summary/MCP, x-enumDescriptions, and const/mock fields) — same class of template-literal injection, different field.

Why it matters for defenders

This isn't a runtime web-app vulnerability — it's a build/codegen-time supply-chain risk. Any project that uses Orval with getBaseUrlFromSpecification: true and generates clients from an OpenAPI spec that isn't fully trusted (fetched from a third party, contributed via PR, aggregated from partner APIs, or otherwise attacker-influenceable) is exposed. Because the payload executes wherever the generated client is loaded or built, this can mean CI/CD runners, developer workstations, or backend services that dynamically regenerate clients — a foothold that's often more privileged and less monitored than a typical web endpoint.

What defenders should watch for or do now

• Inventory whether your org uses Orval, and specifically whether getBaseUrlFromSpecification is enabled in any orval.config.ts/generator config.
• Treat any OpenAPI specification from an external or semi-trusted source as untrusted input before running it through codegen — validate/sanitize the servers[].url field, or reject specs containing backticks or ${ sequences in URL fields.
• Audit CI/CD pipelines that run Orval codegen automatically against specs pulled from external repos, partner integrations, or upstream vendors.
• Watch build/CI logs and file-integrity monitoring for unexpected file writes or process spawns during codegen steps — the PoC pattern shows arbitrary Node.js execution (e.g., filesystem writes) triggered simply by calling a generated client function.
• Once a patched Orval release is available, upgrade and re-generate clients; in the interim, consider disabling getBaseUrlFromSpecification if spec provenance can't be fully trusted.

Developing intel

This is a same-day advisory disclosure with a public PoC but, as of this writing, no confirmed vendor patch version, CVSS score, or evidence of in-the-wild exploitation — treat details as preliminary and monitor the advisory for updates. Full technical details, the maintainer report, and the reproduction files are available at the original source: GHSA-88f2-fpv8-89q2.