CVE-2026-62680

In Orval versions before 8.22.0, the affected code in packages/orval/src/import-specs.ts loads external $ref values without any allowlist or directory confinement. Processing a malicious OpenAPI spec can trigger outbound requests to attacker-chosen or internal HTTP services, read absolute or out-...

CVE-2025-62680

creationtimestamp| type| source ---|---|--- 2025-10-21 04:58:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m3oka2igso2o...

CVE-2025-62680

CVE-2025-62680 entry is rejected/not used and does not represent an active vulnerability.

CVE-2025-62680

...