https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:17:12 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-62682 <p>Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.</p> <p>Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in servers[0].url is emitted into request URL template literals generated when output.baseUrl.getBaseUrlFromSpecification is enabled without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request or URL-builder function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts function getFullRoute. This issue is fixed in version 8.21.0.</p> https://db.gcve.eu/vuln/fkie_cve-2026-62682 https://db.gcve.eu/vuln/ghsa-88f2-fpv8-89q2 <p><strong>Affected:</strong> npm: orval</p> <p>### Summary</p> <p>When Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec&#39;s `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.</p> <p>### Details</p> <p>```ts return `http://api.x/` + (globalThis.X = require(&#34;fs&#34;).writeFileSync(&#34;/marker&#34;,&#34;pwned&#34;)) + `/v1/u`; ```</p> <p>Prerequisite: the documented `getBaseUrlFromSpecification: true` option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server `url` field. Distinct from Orval&#39;s published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).</p> <p>### PoC</p> <p>`reproduce.sh` (+ `make_spec.py`) attached: generates a fetch client with `getBaseUrlFromSpecification: true`, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.</p> <p>### Impact</p> <p>With that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.</p> <p>### Suggested fix</p> <p>Escape the server URL before emitting it into the URL template literal (escape backtick and `$…</p> <p><strong>Affected:</strong> npm: orval</p> <p>### Summary</p> <p>When Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec&#39;s `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.</p> <p>### Details</p> <p>```ts return `http://api.x/` + (globalThis.X = require(&#34;fs&#34;).writeFileSync(&#34;/marker&#34;,&#34;pwned&#34;)) + `/v1/u`; ```</p> <p>Prerequisite: the documented `getBaseUrlFromSpecification: true` option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server `url` field. Distinct from Orval&#39;s published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).</p> <p>### PoC</p> <p>`reproduce.sh` (+ `make_spec.py`) attached: generates a fetch client with `getBaseUrlFromSpecification: true`, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.</p> <p>### Impact</p> <p>With that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.</p> <p>### Suggested fix</p> <p>Escape the server URL before emitting it into the URL template literal (escape backtick and `$…</p> https://db.gcve.eu/vuln/ghsa-88f2-fpv8-89q2