---
id: CVE-2026-62681
title: >-
  Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and
  Swagger v2 specifications
summary: >-
  Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and
  Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an
  OpenAPI path is emitted into request URL template literals generated for
  axios, fetch,…
severity: critical
cwe:
  - CWE-94
  - CWE-116
  - CWE-1336
vendor: orval
product: orval
affected:
  - orval < 8.21.0
patched:
  - orval 8.21.0
published: '2026-08-19'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:20:38.860'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62681'
references:
  - url: >-
      https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
    label: security-advisories@github.com
  - url: 'https://github.com/orval-labs/orval/pull/3692'
    label: security-advisories@github.com
  - url: 'https://github.com/orval-labs/orval/releases/tag/v8.21.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7
    label: security-advisories@github.com
  - url: >-
      https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-62681'
  - url: 'https://github.com/advisories/GHSA-fg9p-mrxr-hvq7'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00653
epssPercentile: 0.49129
aliases:
  - GHSA-fg9p-mrxr-hvq7
ecosystem: npm
ingestedAt: '2026-09-03T20:08:06.880Z'
---

## Overview

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-62681)

Affected packages:

- `orval < 8.21.0`

Patched in:

- `orval 8.21.0`

Source: https://github.com/advisories/GHSA-fg9p-mrxr-hvq7