CVE-2026-62680

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

Summary

Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers the $ref resolver.

Details

• $ref: http://attacker/internal-evil.json#/... → build host fetches (SSRF) and inlines the remote schema (RFI); confirmed property REMOTE_ORVAL_PROP in the generated client.
• $ref: /abs/path.json#/... or ../../secret.json#/... → out-of-tree local file read + inlined (LFI).

No RCE: on 8.19.0 the description JSDoc is escaped (*/->*\/, the published fix), so $ref content cannot break out into code. The chain stops at SSRF + RFI + LFI.

Fix: don't resolve remote $refs by default (opt-in + host allowlist); confine local $ref resolution to the input directory tree (reject absolute paths and ../ escapes).

PoC

reproduce.sh attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema inlined). Verified on Orval 8.19.0.

Impact

Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

Summary

Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers the $ref resolver.

Details

• $ref: http://attacker/internal-evil.json#/... → build host fetches (SSRF) and inlines the remote schema (RFI); confirmed property REMOTE_ORVAL_PROP in the generated client.
• $ref: /abs/path.json#/... or ../../secret.json#/... → out-of-tree local file read + inlined (LFI).

No RCE: on 8.19.0 the description JSDoc is escaped (*/->*\/, the published fix), so $ref content cannot break out into code. The chain stops at SSRF + RFI + LFI.

Fix: don't resolve remote $refs by default (opt-in + host allowlist); confine local $ref resolution to the input directory tree (reject absolute paths and ../ escapes).

PoC

reproduce.sh attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema inlined). Verified on Orval 8.19.0.

Impact

Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).

Root has patched CVE-2026-62680 in the orval package for Root:npm. Multiple fixed versions available.