THREAT OPS › Threat News › [GHSA] GHSA-88f2-fpv8-89q2 (critical) — Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
[GHSA] GHSA-88f2-fpv8-89q2 (critical) — Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
GHSA-88f2-fpv8-89q2 Severity: critical CVE: CVE-2026-62682
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
### Summary
When Orval is configured with `output.baseUrl.getBaseUrlFromSpecification: true`, it bakes the spec's `servers[0].url` into the generated request URL as a template literal without escaping the backtick. A server URL cont
Indicators of compromise
- CVE-2026-62682cve
- CVE-2026-22785cve
- CVE-2026-23947cve
- CVE-2026-25141cve
- CVE-2026-24132cve
- http://api.x/`url
Original source: https://github.com/advisories/GHSA-88f2-fpv8-89q2