Remote Code Execution and File Reading Vulnerability in Orval by Orval Labs

CVE-2026-62680

What is CVE-2026-62680?

Orval is a tool that generates type-safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. In versions before 8.22.0, it improperly handles external reference values, allowing potential exploitation through malicious OpenAPI descriptions. This vulnerability enables attackers to send requests to arbitrary internal HTTP services, read sensitive local files, and inject untrusted remote schemas into the generated clients. The flaw resides in how Orval processes these external references without adequate restriction, thereby posing significant security risks. Users are urged to update to version 8.22.0 or later to mitigate this issue.

References