ROOT-APP-NPM-CVE-2026-62680 CVE-2026-62680 in orval - Patched by Root

Root has patched CVE-2026-62680 in the orval package for Root:npm. Multiple fixed versions available...

CVE-2026-62680

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:16+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-cxq5-97v7-87j8...

@testurio/cli (>=0.6.3, <=0.7.3) potentially affected by CVE-2026-62680 via orval (8.5.3)

orval NPM version 8.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on orval and may be impacted: - @testurio/cli =0.6.3, =0.7.3 Source cves: CVE-2026-62680 Source advisory: OSV:GHSA-CXQ5-97V7-87J8...

CVE-2026-62680

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cau...

CVE-2026-62680

In Orval versions before 8.22.0, the affected code in packages/orval/src/import-specs.ts loads external $ref values without any allowlist or directory confinement. Processing a malicious OpenAPI spec can trigger outbound requests to attacker-chosen or internal HTTP services, read absolute or out-...