PT-2026-78546 · Npm · Orval
CVE-2026-62682
·
Published
2026-08-19
·
Updated
2026-09-03
CVSS v4.0
9.3
Critical
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Orval versions prior to 8.21.0
Description
An unescaped backtick in
servers[0].url is emitted into request URL template literals when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This allows attacker-controlled JavaScript to be evaluated during the execution of a generated request or URL-builder function, leading to code execution in the developer, CI, test, or application environment. The issue resides in the getFullRoute() function within packages/core/src/getters/route.ts.Recommendations
Update to version 8.21.0.
Exploit
Fix
Improper Encoding or Escaping of Output
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Orval