CVE-2026-62680: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval’s published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers the $ref resolver.