ROOT-APP-NPM-CVE-2026-62680 CVE-2026-62680 in orval - Patched by Root

Root has patched CVE-2026-62680 in the orval package for Root:npm. Multiple fixed versions available...

CVE-2026-62680

creationtimestamp| type| source ---|---|--- 2026-09-02 16:35:16+00:00| published-proof-of-concept| https://github.com/advisories/GHSA-cxq5-97v7-87j8...

CVE-2026-62680

Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cau...

CVE-2026-62680

In Orval versions before 8.22.0, the affected code in packages/orval/src/import-specs.ts loads external $ref values without any allowlist or directory confinement. Processing a malicious OpenAPI spec can trigger outbound requests to attacker-chosen or internal HTTP services, read absolute or out-...