EUVD-2026-62659
GHSA-cxq5-97v7-87j8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Network-delivered via crafted spec with no attacker privileges; UI:R since victim must invoke Orval; high confidentiality from SSRF and arbitrary file read.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
AnalysisAI
External $ref resolution in Orval prior to version 8.22.0 allows server-side request forgery and path traversal against the developer or CI host that processes an attacker-controlled OpenAPI or Swagger specification. Any OpenAPI description containing crafted $ref values - pointing to internal HTTP services, cloud metadata endpoints such as the AWS IMDSv1 endpoint, or absolute local file paths - is resolved unconditionally by Orval's import-specs.ts loader with no allowlist or directory confinement. Beyond data exfiltration, untrusted remote schemas are inlined directly into the generated TypeScript client, potentially introducing malicious type definitions into downstream codebases. No active exploitation is confirmed (not in CISA KEV), but the network-delivery path with no authentication requirement makes this a meaningful supply chain risk for teams that process third-party OpenAPI descriptions.
Technical ContextAI
Orval (cpe:2.3:a:orval-labs:orval:*:*:*:*:*:*:*:*) is a TypeScript codegen tool that parses OpenAPI v3 and Swagger v2 specifications and emits strongly-typed HTTP client code. OpenAPI and Swagger schemas support $ref pointers that reference external documents via local file paths or remote URLs. CWE-22 (Path Traversal) captures the root cause: prior to 8.22.0, the external reference loader in packages/orval/src/import-specs.ts performed no confinement to the input directory and maintained no allowlist of permitted targets, so any $ref value - including absolute paths like /etc/passwd or URLs pointing to 169.254.169.254 - was resolved and its content incorporated into the code generation pipeline. The fix in v8.22.0 (PR #3723, commit 23786c056) introduces an externalRefs.allow configuration defaulting to an empty list (block all external refs by default), with an explicit opt-in wildcard ['*'] that restores pre-fix behavior with a warning. The vulnerability spans both SSRF and path traversal primitives simultaneously, making it a compound information-disclosure issue.
RemediationAI
Upgrade to orval version 8.22.0 or later; the vendor-released patch is confirmed at https://github.com/orval-labs/orval/releases/tag/v8.22.0 with the underlying fix in PR #3723. Version 8.22.0 changes the default behavior to block all external $ref resolution - teams that legitimately require external references must explicitly list trusted document targets in parserOptions.externalRefs.allow. Using the wildcard allow: ['*'] restores the old behavior but emits a warning and should be treated as a temporary measure only for internally audited specs. As a compensating control where immediate upgrade is not feasible, restrict Orval execution to OpenAPI specs sourced exclusively from internally controlled, audited repositories, and run Orval in a network-isolated container with no access to cloud metadata endpoints (e.g., blocking 169.254.169.254) and no host secret mounts - this limits SSRF and file-read blast radius but does not prevent malicious schema injection into generated output files.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 or Swagger v2 specification execute arbitra
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed exec
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
I analyzed the provided intelligence and produced the synthesis below. One thing to flag first: **⚠️ Prompt-injection n
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today