CVE-2026-62680: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Summary
Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers the $ref resolver.
Details
- $ref: http://attacker/internal-evil.json#/... → build host fetches (SSRF) and inlines the remote schema (RFI); confirmed property REMOTEORVALPROP in the generated client. - $ref: /abs/path.json#/... or ../../secret.json#/... → out-of-tree local file read + inlined (LFI).
No RCE: on 8.19.0 the description JSDoc is escaped (/->\/, the published fix), so $ref content cannot break out into code. The chain stops at SSRF + RFI + LFI.
Fix: don't resolve remote $refs by default (opt-in + host allowlist); confine local $ref resolution to the input directory tree (reject absolute paths and ../ escapes).
PoC
reproduce.sh attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema inlined). Verified on Orval 8.19.0.
Impact
Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).
Other sources
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.22.0 - Upgrade
Upgrade
orvalto a version that resolves this vulnerability.Fixed in 8.22.0 - Configuration
Do not resolve remote $ref values by default; require explicit opt-in and use a host allowlist for remote http(s) $ref fetching.
Orval $ref resolver (packages/orval/src/import-specs.ts) remote $ref resolution = disabled_by_default (opt-in required) - Configuration
Constrain local $ref resolution to the input directory tree: reject absolute paths and paths containing `../` escapes so local files cannot be read out-of-tree.
Orval $ref resolver (packages/orval/src/import-specs.ts) local $ref path confinement = restrict_to_input_directory
Event History
Frequently Asked Questions
Who is most exposed to this issue?
Developers and CI systems running Orval before 8.22.0 are exposed when they process an attacker-controlled OpenAPI v3 or Swagger v2 description. The requests and file reads occur from the host performing generation.
What must an attacker control to exploit it?
An attacker needs to supply or influence an API specification containing external $ref values. Those references can point to attacker-selected or internal HTTP services, absolute local paths, or files outside the input directory.
How can I determine whether my environment is affected?
Check whether Orval is earlier than 8.22.0 and whether it processes OpenAPI or Swagger specifications from untrusted or externally influenced sources. The affected behavior is external reference loading in packages/orval/src/import-specs.ts.
What should be done if this is identified?
Upgrade Orval to version 8.22.0, which fixes the issue. Until upgraded, avoid processing attacker-controlled API descriptions because external $ref values can trigger network requests and local file inclusion during generation.