CVE-2026-62680: fallo de gravedad alta en orval-labs orval
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.1epss 0.4%
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Productos afectados
orval-labs · orvalCVEs relacionadas — orval-labs orval
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-96756CRITICALorval before 8.30.0 Code Injection via Factory GenerationEPSS 0.9%CVE-2026-23947CRITICALOrval MCP client is vulnerable to code injection via unsanitized x-enum-descriptions in enum generationEPSS 0.8%CVE-2026-96757CRITICALorval before 8.29.0 Code Injection via unescaped OpenAPI media-typeEPSS 0.8%CVE-2026-96758CRITICALorval @orval/core before 8.28.0 Code Injection via Form-DataEPSS 0.8%CVE-2026-96755CRITICALorval @orval/effect 8.14.0 through 8.28.1 Code InjectionEPSS 0.8%CVE-2026-22785CRITICALorval MCP client is vulnerable to a code injection attack.EPSS 0.8%