{"id":"CVE-2026-62682","aliases":["GHSA-88f2-fpv8-89q2"],"url":"https://o3.security/vulnerability/CVE-2026-62682","summary":"Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)","details":"### Summary\n\nWhen Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec's `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.\n\n### Details\n\n```ts\nreturn `http://api.x/` + (globalThis.X = require(\"fs\").writeFileSync(\"/marker\",\"pwned\")) + `/v1/u`;\n```\n\nPrerequisite: the documented `getBaseUrlFromSpecification: true` option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server `url` field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).\n\n### PoC\n\n`reproduce.sh` (+ `make_spec.py`) attached: generates a fetch client with `getBaseUrlFromSpecification: true`, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.\n\n### Impact\n\nWith that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.\n\n### Suggested fix\n\nEscape the server URL before emitting it into the URL template literal (escape backtick and `${`), or build the base URL with an encoder that treats it as data; validate the URL.\n[maintainer-report.txt](https://github.com/user-attachments/files/29396562/maintainer-report.txt)\n[make_spec.py](https://github.com/user-attachments/files/29396563/make_spec.py)\n[reproduce.sh](https://github.com/user-attachments/files/29396564/reproduce.sh)","published":"2026-08-19T17:40:17.061Z","modified":"2026-09-11T03:30:44.758488184Z","cvss":null,"epss":{"score":0.00624,"percentile":0.48355,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"orval","fixedVersion":"8.21.0"}],"fix":{"url":"https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6","label":"orval-labs/orval@8ef1bfd"},"references":[{"type":"WEB","url":"https://github.com/orval-labs/orval/releases/tag/v8.21.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62682.json"},{"type":"ADVISORY","url":"https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62682"},{"type":"FIX","url":"https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6"},{"type":"FIX","url":"https://github.com/orval-labs/orval/pull/3692"},{"type":"PACKAGE","url":"https://github.com/orval-labs/orval"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T03:30:44.758488184Z"}}