CVE-2026-62681

CriticalCVSS 9.3/10Last modified Sep 9, 2026

Description

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-94 CWE-116 CWE-1336

Affected software

No affected versions have been published.

Timeline

Published: Aug 19, 2026
Last modified: Sep 9, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-626829.3Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped back CVE-2026-626833.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-626842.7File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-626858.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Pri CVE-2026-626875.5Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose informatio CVE-2026-626887.8Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.CVE-2026-62695.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.10.8, 18.11 before 18.11.5, and 19.0 before 19.0.CVE-2026-626907.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authoriz CVE-2026-626927.8Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.CVE-2026-626937.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows MIDI Service Module allows an authori CVE-2026-626947.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-626957.8Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.