ROOT-APP-NPM-CVE-2026-62680 CVE-2026-62680 in orval - Patched by Root

Root has patched CVE-2026-62680 in the orval package for Root:npm. Multiple fixed versions available...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62680 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-62680 Source advisory: OSV:GHSA-CXQ5-97V7-87J8...

CVE-2026-62680

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cau...

CVE-2026-62680

In Orval versions before 8.22.0, the affected code in packages/orval/src/import-specs.ts loads external $ref values without any allowlist or directory confinement. Processing a malicious OpenAPI spec can trigger outbound requests to attacker-chosen or internal HTTP services, read absolute or out-...

CVE-2025-62680

creationtimestamp| type| source ---|---|--- 2025-10-21 04:58:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3oka2igso2o...

CVE-2025-62680

CVE-2025-62680 entry is rejected/not used and does not represent an active vulnerability.

CVE-2025-62680

...