{"id":"CVE-2026-62680","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-62680","summary":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without…","details":"Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.","published":"2026-08-19T18:16:54.230","modified":"2026-08-19T18:16:54.230","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10","label":"orval-labs/orval@23786c0"},"references":[{"type":"WEB","url":"https://github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10"},{"type":"WEB","url":"https://github.com/orval-labs/orval/pull/3723"},{"type":"WEB","url":"https://github.com/orval-labs/orval/releases/tag/v8.22.0"},{"type":"WEB","url":"https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8"},{"type":"WEB","url":"https://github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T18:16:54.230"}}