CVE-2026-62680

In Orval versions before 8.22.0, the affected code in packages/orval/src/import-specs.ts loads external $ref values without any allowlist or directory confinement. Processing a malicious OpenAPI spec can trigger outbound requests to attacker-chosen or internal HTTP services, read absolute or out-...