CVE-2026-62680
Received Received - Intake

Remote File Inclusion in Orval Prior to 8.22.0

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-62680
EUVD
EUVD-2026-62659

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
orval orval 8.22.0
orval orval to 8.22.0 (exc)
orval-labs orval to 8.22.0 (exc)
orval-labs orval 8.22.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Orval is a tool that generates JavaScript clients from OpenAPI specifications. Prior to version 8.22.0, it could process attacker-controlled OpenAPI files that reference external resources via $ref without restrictions. This allowed requests to internal or external HTTP services, reading local files outside the project directory, or including untrusted remote schemas in generated clients.

Detection Guidance

To detect this vulnerability, check if your Orval version is below 8.22.0 by running: npm list orval or yarn list orval. If the version is older, the system is vulnerable to SSRF, RFI, or LFI via $ref resolution in OpenAPI specs.

Impact Analysis

An attacker could craft an OpenAPI file that, when processed by Orval, makes requests from your system to internal or external services, reads sensitive local files, or includes malicious remote content. This could lead to data leaks, unauthorized network access, or compromised builds during development or CI.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data (e.g., local files containing personal or health information), violating GDPR or HIPAA requirements for data protection and access control. Organizations using Orval may face compliance risks if exploited.

Mitigation Strategies

Upgrade Orval to version 8.22.0 or later using: npm update orval or yarn upgrade orval. Then configure parserOptions.externalRefs.allow in your Orval config to explicitly allow only trusted external references. Avoid using ['*'] unless necessary.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62680. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart