CVE-2026-62680: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Orvalto a version that resolves this vulnerability.Fixed in 8.22.0
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Developers and CI systems running Orval before 8.22.0 are exposed when they process an attacker-controlled OpenAPI v3 or Swagger v2 description. The requests and file reads occur from the host performing generation.
What must an attacker control to exploit it?
An attacker needs to supply or influence an API specification containing external $ref values. Those references can point to attacker-selected or internal HTTP services, absolute local paths, or files outside the input directory.
How can I determine whether my environment is affected?
Check whether Orval is earlier than 8.22.0 and whether it processes OpenAPI or Swagger specifications from untrusted or externally influenced sources. The affected behavior is external reference loading in packages/orval/src/import-specs.ts.
What should be done if this is identified?
Upgrade Orval to version 8.22.0, which fixes the issue. Until upgraded, avoid processing attacker-controlled API descriptions because external $ref values can trigger network requests and local file inclusion during generation.