{"id":"CVE-2026-62680","aliases":["EUVD-2026-62659","GHSA-cxq5-97v7-87j8","ROOT-APP-NPM-CVE-2026-62680"],"status":"published","title":"Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00403,"percentile":0.34836,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22","CWE-829","CWE-918"],"published":"2026-08-19T17:42:11Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"npm","package":"orval","fixed_in":["8.22.0"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"orval","fixed_in":["7.21.0-aikido.4","7.21.0-aikido.5","7.13.2-aikido.2","7.13.2-aikido.1","7.13.2-aikido.3","7.21.0-aikido.2","7.21.0-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/orval","fixed_in":["7.21.0-root.io.4","7.21.0-root.io.5","7.13.2-root.io.2","7.13.2-root.io.1","7.13.2-root.io.3","7.21.0-root.io.2","7.21.0-root.io.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"orval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.22.0"}]}]},{"source":"osv","ecosystem":"npm","package":"orval","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"8.22.0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"orval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-aikido.4"},{"fixed":"7.21.0-aikido.5"},{"fixed":"7.13.2-aikido.2"},{"fixed":"7.13.2-aikido.1"},{"fixed":"7.13.2-aikido.3"},{"fixed":"7.21.0-aikido.2"},{"fixed":"7.21.0-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/orval","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.21.0-root.io.4"},{"fixed":"7.21.0-root.io.5"},{"fixed":"7.13.2-root.io.2"},{"fixed":"7.13.2-root.io.1"},{"fixed":"7.13.2-root.io.3"},{"fixed":"7.21.0-root.io.2"},{"fixed":"7.21.0-root.io.3"}]}]}],"products":[{"vendor":"orval-labs","product":"orval"}],"references":[{"url":"https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/orval-labs/orval/pull/3723","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/orval-labs/orval/releases/tag/v8.22.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62680","tags":["advisory"]},{"url":"https://github.com/orval-labs/orval/pull/3692","tags":["web"]},{"url":"https://github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cxq5-97v7-87j8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62680.json","tags":["advisory"]},{"url":"https://github.com/orval-labs/orval","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-62680","title":"Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.","status":"published","published":"2026-08-19T17:42:11.227Z","modified":"2026-08-19T18:06:47.948Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-22","CWE-829","CWE-918"],"updated_at":"2026-11-02T14:20:14.999906Z"}],"euvd":[{"id":"EUVD-2026-62659","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.","status":"published","published":"2026-08-19T17:42:11Z","modified":"2026-08-19T18:06:47Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T18:01:41.405951Z"}],"ghsa":[{"id":"GHSA-cxq5-97v7-87j8","title":"Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref","description":"### Summary\n\nOrval resolves OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files (including\nabsolute / out-of-tree paths), inlining the referenced schema into the generated client. Running\n`orval` on a spec whose `$ref` points at an attacker/internal URL or an arbitrary local file yields\nSSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class\nfrom Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers\nthe `$ref` resolver.\n\n### Details\n\n- `$ref: http://attacker/internal-evil.json#/...` → build host fetches (SSRF) and inlines the remote\n  schema (RFI); confirmed property `REMOTE_ORVAL_PROP` in the generated client.\n- `$ref: /abs/path.json#/...` or `../../secret.json#/...` → out-of-tree local file read + inlined (LFI).\n\nNo RCE: on 8.19.0 the description JSDoc is escaped (`*/`-\u003e`*\\/`, the published fix), so `$ref` content\ncannot break out into code. The chain stops at SSRF + RFI + LFI.\n\nFix: don't resolve remote `$ref`s by default (opt-in + host allowlist); confine local `$ref`\nresolution to the input directory tree (reject absolute paths and `../` escapes).\n\n### PoC\n\n`reproduce.sh` attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema\ninlined). Verified on Orval 8.19.0.\n\n### Impact\n\nBuild-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).","status":"published","published":"2026-09-02T14:54:48Z","modified":"2026-09-02T14:54:50Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-829","CWE-918"],"updated_at":"2026-11-02T14:41:10.121131Z"}],"nvd":[{"id":"CVE-2026-62680","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.","status":"published","published":"2026-08-19T18:16:54.23Z","modified":"2026-09-09T21:20:38.86Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-22","CWE-829","CWE-918"],"updated_at":"2026-11-02T14:12:39.962615Z"}],"osv":[{"id":"CVE-2026-62680","title":"Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref","description":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.","status":"published","published":"2026-08-19T17:42:11.227Z","modified":"2026-10-28T02:30:46.942589083Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-829","CWE-918"],"updated_at":"2026-11-02T15:45:13.306117Z"},{"id":"GHSA-cxq5-97v7-87j8","title":"Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref","description":"### Summary\n\nOrval resolves OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files (including\nabsolute / out-of-tree paths), inlining the referenced schema into the generated client. Running\n`orval` on a spec whose `$ref` points at an attacker/internal URL or an arbitrary local file yields\nSSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class\nfrom Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers\nthe `$ref` resolver.\n\n### Details\n\n- `$ref: http://attacker/internal-evil.json#/...` → build host fetches (SSRF) and inlines the remote\n  schema (RFI); confirmed property `REMOTE_ORVAL_PROP` in the generated client.\n- `$ref: /abs/path.json#/...` or `../../secret.json#/...` → out-of-tree local file read + inlined (LFI).\n\nNo RCE: on 8.19.0 the description JSDoc is escaped (`*/`-\u003e`*\\/`, the published fix), so `$ref` content\ncannot break out into code. The chain stops at SSRF + RFI + LFI.\n\nFix: don't resolve remote `$ref`s by default (opt-in + host allowlist); confine local `$ref`\nresolution to the input directory tree (reject absolute paths and `../` escapes).\n\n### PoC\n\n`reproduce.sh` attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema\ninlined). Verified on Orval 8.19.0.\n\n### Impact\n\nBuild-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).","status":"published","published":"2026-09-02T14:54:48Z","modified":"2026-09-02T15:00:08.972025908Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"cwes":["CWE-22","CWE-829","CWE-918"],"updated_at":"2026-11-02T15:46:45.639885Z"},{"id":"ROOT-APP-NPM-CVE-2026-62680","title":"CVE-2026-62680 in orval - Patched by Root","description":"Root has patched CVE-2026-62680 in the orval package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-09-21T06:43:17Z","modified":"2026-09-21T07:15:06.412500225Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}