THREAT OPS › Threat News › [GHSA] GHSA-fg9p-mrxr-hvq7 (critical) — Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
[GHSA] GHSA-fg9p-mrxr-hvq7 (critical) — Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
GHSA-fg9p-mrxr-hvq7 Severity: critical CVE: CVE-2026-62681
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
### Summary
Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (`` `/users/...` ``) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation express
Indicators of compromise
- CVE-2026-62681cve
- CVE-2026-22785cve
- CVE-2026-23947cve
- CVE-2026-25141cve
- CVE-2026-24132cve
Original source: https://github.com/advisories/GHSA-fg9p-mrxr-hvq7