CVE-2026-62681

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.

• CWE-94
• CWE-116
• CWE-1336

• https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
• https://github.com/orval-labs/orval/pull/3692
• https://github.com/orval-labs/orval/releases/tag/v8.21.0
• https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7
• https://github.com/orval-labs/orval/security/advisories/GHSA-fg9p-mrxr-hvq7

Published

Aug 19, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62674Omnigent is an open-source AI agent framework and meta-harne…9
• CVE-2026-62675Omnigent is an open-source AI agent framework and meta-harne…8.8
• CVE-2026-62676Omnigent is an open-source AI agent framework and meta-harne…7.1
• CVE-2026-62677Omnigent is an open-source AI agent framework and meta-harne…8.8
• CVE-2026-6268The EventPress WordPress theme before 22.2 does not sanitize…7.1
• CVE-2026-62680Orval generates type-safe JavaScript clients in TypeScript f…7.1
• CVE-2026-62682Orval generates type-safe JavaScript clients in TypeScript f…9.3
• CVE-2026-62683File Browser is a file managing interface for uploading, del…3.1
• CVE-2026-62684File Browser is a file managing interface for uploading, del…2.7
• CVE-2026-62685File Browser is a file managing interface for uploading, del…8.1
• CVE-2026-62688Heap-based buffer overflow in Windows MIDI Service Module al…7.8
• CVE-2026-6269GitLab has remediated an issue in GitLab CE/EE affecting all…5.4