GHSA-cxq5-97v7-87j8: Path Traversal
Summary
Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers the $ref resolver.
Details
- $ref: http://attacker/internal-evil.json#/... → build host fetches (SSRF) and inlines the remote schema (RFI); confirmed property REMOTEORVALPROP in the generated client. - $ref: /abs/path.json#/... or ../../secret.json#/... → out-of-tree local file read + inlined (LFI).
No RCE: on 8.19.0 the description JSDoc is escaped (/->\/, the published fix), so $ref content cannot break out into code. The chain stops at SSRF + RFI + LFI.
Fix: don't resolve remote $refs by default (opt-in + host allowlist); confine local $ref resolution to the input directory tree (reject absolute paths and ../ escapes).
PoC
reproduce.sh attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema inlined). Verified on Orval 8.19.0.
Impact
Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/orvalto a version that resolves this vulnerability.Fixed in 8.22.0 - Upgrade
Upgrade
orvalto a version that resolves this vulnerability.Fixed in 8.19.0 - Configuration
Do not resolve remote $ref URLs by default; require opt-in and allowlist only trusted hosts for resolving http(s) remote $ref.
Orval $ref resolver remote $ref resolution = disabled_by_default (opt-in) + host_allowlist - Configuration
When resolving local $ref targets, restrict resolution to the input directory tree; reject absolute paths and any '../' escapes (out-of-tree local file reads/LFI prevention).
Orval $ref resolver local $ref path resolution = confined_to_input_directory_tree + reject_absolute_and_traversal - Compensating control
If running the generator in CI/developer environments, isolate the build host/network (reduce exposure to SSRF by limiting egress from the generator to only required/internal destinations).
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Build or development hosts are exposed when they run Orval against an OpenAPI specification containing attacker-controlled or untrusted $ref values. The affected resolver can make network requests from the build host and read files accessible to that host.
What does an attacker need to exploit it?
An attacker needs a victim to run Orval on a specification that includes a malicious remote, absolute, or directory-traversal $ref. The supplied vector indicates no privileges are required, but user interaction is required to cause the spec to be processed.
How can teams determine whether their specifications may be affected?
Review OpenAPI $ref entries for http or https URLs, absolute local paths, and relative paths containing ../. Generated client output containing schema properties sourced from an unexpected remote reference is also evidence that a remote $ref was resolved.
What can be done if patching is not immediately possible?
Do not process untrusted specifications, and reject or remove remote $refs unless they are explicitly required and limited by a host allowlist. Restrict local $ref resolution to the input directory tree and reject absolute paths and ../ escapes.
Does this issue enable code execution through generated client output?
The reported behavior on version 8.19.0 does not achieve RCE because description JSDoc content is escaped and cannot break into generated code. The reported impact is SSRF plus remote and local file inclusion into the generated client.