CVE-2026-62680 PUBLISHED

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Assigner: GitHub_M
Reserved: 14.07.2026 Published: 19.08.2026 Updated: 19.08.2026

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CVSS Score: 7.1

Product Status

Vendor orval-labs
Product orval
Versions
  • Version < 8.22.0 is affected

References

Problem Types

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE
  • CWE-829: Inclusion of Functionality from Untrusted Control Sphere CWE
  • CWE-918: Server-Side Request Forgery (SSRF) CWE