CVE-2026-62680
HighCVSS 7.1Summary
Orval before 8.22.0 resolves external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI specification can cause requests to attacker-selected HTTP services, read local files outside the project tree, and inline untrusted schemas into generated clients.
Risk Assessment
Developers or CI systems can be exploited for SSRF, local file disclosure, or injection of malicious code into generated clients, threatening confidentiality and integrity.
Recommendation
Update Orval to version 8.22.0 or later, which includes the fix.
Original NVD description (English source)
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.