CVE-2026-62681: Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Orval generates TypeScript clients from an OpenAPI description. It emits each path as a template literal such as ` /users/ `. A path that contains a backtick closes the literal and injects a concatenation expression. The generated code looks like this:

return `/users/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/list`;

A trailing backtick reopens a literal, so the file stays valid. The injected expression runs each time the generated request function, URL builder or query-key function is called. The payload passes Orval's default OpenAPI validation. The reporter verified it on 8.19.0 with the fetch client.

The attacker needs to control or influence the OpenAPI document that you feed to Orval: a third-party API spec, a spec pulled from a URL, or a pull request that edits the spec file. They get code execution in whatever environment calls the generated client: a developer machine, a CI job, or the running application. That can expose tokens, source and deploy credentials. The path field is a different field and sink from the earlier Orval advisories CVE-2026-22785, CVE-2026-23947, CVE-2026-25141 and CVE-2026-24132, which their fixes did not cover.

The orval npm package before 8.21.0. The advisory verified 8.19.0. The generated axios, fetch, react-query and swr clients are affected. Code you generated earlier keeps the flaw until you regenerate it.

npm ls orval

Also search generated client files for backticks inside URL strings built from spec paths, and check where your OpenAPI specs come from.

Upgrade to 8.21.0, then regenerate your clients.

npm install [email protected]

The fix is pull request 3692 (commit 8ef1bfd). The reporter's suggestion is to escape backticks and ${ in the path before it is emitted, or to build the URL with an encoder that treats the path as data. The advisory lists no workaround. Until you upgrade, generate only from OpenAPI documents you trust and review spec changes in pull requests for backticks in paths keys.

Search your OpenAPI specs for backticks or ${ in paths keys:

grep -rn '`' openapi.yaml openapi.json

Search generated clients for require(, globalThis or child_process inside URL expressions. On build machines and CI, look for unexpected files or outbound connections created when generated client code is executed.

Summary

Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (` /users/... `) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval's default OpenAPI validation.

Details

// generated URL builder (fetch client)
return `/users/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/list`;

The backtick in the path terminates the ` ... literal; + () +` runs as a live expression; a trailing backtick reopens a template literal so the file stays valid. The code runs whenever the generated request function, URL builder, or query-key function is called.

This is distinct from Orval's four published CVEs: CVE-2026-22785 (summary -> MCP server), CVE-2026-23947 / CVE-2026-25141 (x-enumDescriptions), and CVE-2026-24132 (const -> mock files). This is a different field (the route path) and a different sink (the request-URL template literal), which those advisories and their fixes do not cover.

PoC

reproduce.sh (+ make_spec.py) attached: generates a fetch client with default validation, bundles it, calls the generated functions, and shows a marker file written. Verified on 8.19.0.

Impact

Code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description (developer, CI, or the running application).

Suggested fix

Escape the path before emitting it into the URL template literal (escape backtick and ${, or build the URL with an encoder that treats the path as data), and validate path characters.