CyberRota Analysis
AI-GeneratedOrval versions prior to 8.22.0 are vulnerable due to improper handling of external $ref values in OpenAPI specifications, allowing attackers to manipulate requests to arbitrary HTTP services and access sensitive local files. This could lead to unauthorized data exposure and potential exploitation of internal services. Organizations using Orval for generating JavaScript clients from OpenAPI specifications should prioritize upgrading to version 8.22.0 to mitigate these risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.