CVE-2026-62680: Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including
absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running
orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields
SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class
from Orval’s published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers
the $ref resolver.
References
- github.com/advisories/GHSA-cxq5-97v7-87j8
- github.com/orval-labs/orval/commit/23786c056f4eba38c02bf2968677988dbbe4de10
- github.com/orval-labs/orval/commit/8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6
- github.com/orval-labs/orval/pull/3692
- github.com/orval-labs/orval/pull/3723
- github.com/orval-labs/orval/releases/tag/v8.22.0
- github.com/orval-labs/orval/security/advisories/GHSA-cxq5-97v7-87j8
- nvd.nist.gov/vuln/detail/CVE-2026-62680
Code Behaviors & Features
Detect and mitigate CVE-2026-62680 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →