Security readout for executives and security teams
Plain-English summary
Orval versions before 8.21.0 can turn a malicious OpenAPI server URL into executable JavaScript when a specific base-URL option is enabled. The injected code runs when affected generated request or URL-builder functions are called, potentially compromising developer machines, CI pipelines, tests, or applications.
Executive priority
Prioritize immediate remediation where external or shared specifications feed automated generation pipelines. A successful compromise could execute code with developer, CI, test, or application privileges. Environments using trusted specifications exclusively remain lower likelihood, but the critical impact supports rapid inventory and upgrade.
Technical view
The getFullRoute function emitted servers[0].url into a JavaScript template literal without safely encoding backticks when output.baseUrl.getBaseUrlFromSpecification was enabled. A crafted specification could therefore introduce JavaScript into generated clients, causing code execution when the affected generated function executes. Version 8.21.0 fixes the flaw.
Likely exposure
Exposure requires Orval below 8.21.0, getBaseUrlFromSpecification enabled, and generation from an attacker-controlled or compromised specification. Risk extends beyond production to developer, CI, and test environments. Systems not meeting these conditions are not shown as affected by the supplied evidence.
Exploitation context
The CVSS 4.0 score is 9.3, reflecting remotely supplied, low-complexity input with severe confidentiality, integrity, and availability impact. The bundle reports no CISA KEV listing and provides no evidence of active exploitation. Exploitation still requires an affected generated request or URL-builder function to be called.
Researcher notes
The reported sink is packages/core/src/getters/route.ts:getFullRoute. Relevant weakness classifications are CWE-116, CWE-1336, and CWE-94. The decisive exposure factors are version, configuration, specification trust boundary, and execution of generated functions. The supplied sources do not establish public exploitation or broader affected configurations.
Mitigation direction
- Upgrade Orval to version 8.21.0 or later.
- Regenerate clients from trusted specifications after upgrading.
- Restrict specification sources and review changes before client generation.
- Treat previously generated clients from untrusted specifications as potentially unsafe.
Validation and detection
- Inventory Orval versions across developer, CI, test, and build environments.
- Identify configurations enabling output.baseUrl.getBaseUrlFromSpecification.
- Trace whether OpenAPI specifications can be supplied or modified by untrusted parties.
- Review generated request URLs for unexpected template-literal content.
- Confirm regenerated clients were produced using Orval 8.21.0 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-116: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-1336: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-62682 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——GitHub_MVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/orval-labs/orval/security/advisories/GHSA-88f2-fpv8-89q2CVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/orval-labs/orval/pull/3692CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6CVE reference, GitHub_M · x_refsource_MISC
- https://github.com/orval-labs/orval/releases/tag/v8.21.0CVE reference, GitHub_M · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.