p PatchFirst

CVE-2026-62680

CVE-2026-62680 · Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

CVSS 7.1 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • orval

    Versions
    • < 8.22.0: Affected

    No fix published

  • orval npm

    Affected ranges
    • SEMVER: < 8.22.0

    Update to 8.22.0

Original sources

Check your server →