Orval npm package has a security flaw

Published September 3, 2026 CVE-2026-62681

Orval is a developer tool that turns API blueprints into ready-to-use code. A booby-trapped blueprint can sneak in commands that run on a developer's machine or build server the moment the generated code is used.

Severity
CriticalCVSS 4.0 · 9.3
Fix
Fixed in 8.21.0Fix recorded on Sep 3, 2026
Affected versions
before 8.21.0
Weakness
CWE-94Code Injection
Exploit likelihood
0.66% in 30 daysEPSS, higher than 50% of known flaws
Affects
Orval+1 more

How it works

  • Orval copies the API's URL paths straight into the generated code using a JavaScript quoting style called a template literal, and it does not remove a special backtick character.
  • A path containing a backtick breaks out of that quoting and turns into live code that runs whenever the generated function is called.

What to do

Run npm ls orval in your project to see the installed version. You are exposed if it is older than 8.21.0 and you generate clients from OpenAPI specs from outside sources.

Run this in the application environment you want to check:

npm ls orval

Update to Orval 8.21.0 or later with npm install orval@8.21.0 (or later), then regenerate your API clients and review any OpenAPI files from outside your own team before running them through Orval.

Technical details

Affected software: Orval, npm

Orval's route generator (packages/core/src/getters/route.ts) writes OpenAPI path values into request URL template literals for its axios, fetch, react-query, and SWR client outputs without escaping backtick characters. A path containing a backtick closes the template literal early, letting a + (...) + expression execute as real JavaScript when the generated request, URL-builder, or query-key function is called, then a trailing backtick reopens the literal so the file still parses. This bypasses Orval's default OpenAPI validation and is distinct from four earlier Orval CVEs that involved different fields and sinks. Fixed in Orval 8.21.0.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure High Sensitive data can be exposed with serious impact
  • Vulnerable system: Data changes High Protected data can be changed with serious impact
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Open in FIRST.org calculator

References

View Original Source