Is CVE-2026-62680 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62680 being exploited in the wild.

How severe is CVE-2026-62680?

High severity, with a CVSS score of 7.1, published 19 August 2026.

Which products and versions are affected?

orval (npm) < 8.22.0, SEMVER:introduced=0,fixed=8.22.0.

Is there a fix for CVE-2026-62680?

Yes. orval (npm): upgrade to 8.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62680 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-62680?

Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62680: Orval SSRF and file inclusion via unrestricted $ref resolution

Q: Which products and versions are affected?

orval (npm) < 8.22.0, SEMVER:introduced=0,fixed=8.22.0.

Q: Is there a fix for CVE-2026-62680?

Yes. orval (npm): upgrade to 8.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-62680 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-62680?

Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62680 · Severity: high · CVSS 7.1 · Published 2026-08-19

Orval is a code generator for OpenAPI specifications that developers and CI/CD systems use to automatically create client code. The tool unsafely resolves $ref pointers in OpenAPI specs by fetching remote URLs and reading local files without proper restrictions, allowing an attacker to craft a malicious spec that causes the build system to fetch internal URLs (SSRF), leak arbitrary local files, or include untrusted remote content in generated code.

Technologies: orval (npm). Vendors: npm.

Quick answers

Is CVE-2026-62680 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62680 being exploited in the wild.
How severe is CVE-2026-62680?: High severity, with a CVSS score of 7.1, published 19 August 2026.
Which products and versions are affected?: orval (npm) < 8.22.0, SEMVER:introduced=0,fixed=8.22.0.
Is there a fix for CVE-2026-62680?: Yes. orval (npm): upgrade to 8.22.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62680 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-62680?: Check whether you run orval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

orval (npm): upgrade to 8.22.0 or later
```
npm install orval@8.22.0
```

Technical details

The vulnerability exists in Orval's $ref resolver component, which processes external references in OpenAPI schemas. The resolver fails to validate remote URLs against an allowlist, permitting arbitrary http(s) requests (CWE-918 SSRF), and fails to confine local file access to the input directory tree, allowing path traversal attacks with absolute paths and ../ sequences (CWE-22). Attackers can craft specs with malicious $ref values pointing to internal services (triggering SSRF from the developer or CI build host) or out-of-tree files (exfiltrating secrets, config files, or other sensitive data). Content from both remote and local sources is then inlined into the generated client code. No remote code execution occurs because JSDoc descriptions are escaped (a fix from prior CVEs), so the attack surface is restricted to information disclosure and SSRF; the fix requires opt-in with host allowlisting for remote resolution and directory-bound path resolution for local files.

Affected products

Orval Labs Orval < 8.22.0

Identifiers

CVE-2026-62680
GHSA-cxq5-97v7-87j8

Timeline

2026-07-14: disclosed: Published to GitHub Advisory Database
2026-08-22: patched: Version 8.22.0 released with fix
2026-09-02: advisory: GitHub Advisory GHSA-cxq5-97v7-87j8 reviewed and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.