Description

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-19T18:16:54.230Z",
  "pubdate": "2026-08-19T18:16:54.230Z",
  "executiveSummary": "Orval prior to version 8.22.0 is vulnerable to unrestricted external reference loading via the processing of OpenAPI v3 and Swagger v2 specifications.\nThe vulnerability allows an attacker-controlled OpenAPI description to trigger arbitrary server-side request forgery (SSRF) and arbitrary local file read operations on the host running the generation process, which may be a developer machine or a CI/CD environment.\nThe flaw stems from the application resolving remote and local external $ref values without enforcing an allowlist or directory confinement constraints.\nSuccessful exploitation enables threat actors to induce requests to attacker-controlled or internal HTTP services, read absolute or out-of-tree local files from the filesystem, and inline untrusted remote schemas directly into the generated TypeScript clients.\nThis introduces severe risk implications, including potential exposure of internal network infrastructure, exfiltration of sensitive local system files, and the injection of malicious or untrusted schemas into downstream client codebases.\nMitigation requires upgrading the Orval package to version 8.22.0 or later, where the external reference loading mechanism has been patched to properly secure reference resolution.",
  "technicalDetails": "The vulnerability resides within the external reference loading mechanism implemented in the vulnerable component packages/orval/src/import-specs.ts.\nThe root cause of the issue is the lack of strict validation, allowlisting, or filesystem confinement when Orval processes remote and local external $ref values encountered within input OpenAPI v3 or Swagger v2 specifications.\nWithout confinement mechanisms, the parser evaluates $ref pointers pointing to arbitrary URIs and file paths outside the expected input directory context.\nThe attack flow initiates when a developer or automated CI/CD pipeline processes a malicious or untrusted OpenAPI description provided by an attacker.\nUpon parsing the specification, the vulnerable import-specs.ts module encounters maliciously crafted $ref directives.\nIf the $ref specifies a file path (e.g., utilizing absolute paths or directory traversal sequences like ../), Orval reads the targeted local file from the underlying filesystem and processes its contents.\nIf the $ref specifies a remote URL, the host executing Orval performs an outbound HTTP request to the attacker-specified endpoint or internal network services, potentially exposing internal infrastructure via SSRF.\nFurthermore, the content retrieved from these external or local resources is inlined directly into the generated type-safe JavaScript and TypeScript clients, potentially compromising the integrity of the generated output.\nThe affected versions include all releases of Orval prior to 8.22.0.\nAuthentication and privilege requirements depend on the execution context, but the attack typically requires no special privileges beyond tricking a user or CI system into processing a malicious specification file.\nNetwork exposure is inherent to environments where developers or CI pipelines process untrusted remote specifications or network-accessible resources."
}