SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-62680

HIGH · CVSS 7.1 EPSS 0.31% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-08-19 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

Orval versions prior to 8.22.0 are vulnerable due to improper handling of external $ref values in OpenAPI specifications, allowing attackers to manipulate requests to arbitrary HTTP services and access sensitive local files. This could lead to unauthorized data exposure and potential exploitation of internal services. Organizations using Orval for generating JavaScript clients from OpenAPI specifications should prioritize upgrading to version 8.22.0 to mitigate these risks.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-62680
Severity
HIGH
CVSS
7.1
EPSS
0.31%
Java

Original NVD Description

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.