Executive brief
Orval is a code generator for OpenAPI specifications that developers and CI/CD systems use to automatically create client code. The tool unsafely resolves $ref pointers in OpenAPI specs by fetching remote URLs and reading local files without proper restrictions, allowing an attacker to craft a malicious spec that causes the build system to fetch internal URLs (SSRF), leak arbitrary local files, or include untrusted remote content in generated code.
Technical details
The vulnerability exists in Orval's $ref resolver component, which processes external references in OpenAPI schemas. The resolver fails to validate remote URLs against an allowlist, permitting arbitrary http(s) requests (CWE-918 SSRF), and fails to confine local file access to the input directory tree, allowing path traversal attacks with absolute paths and ../ sequences (CWE-22). Attackers can craft specs with malicious $ref values pointing to internal services (triggering SSRF from the developer or CI build host) or out-of-tree files (exfiltrating secrets, config files, or other sensitive data). Content from both remote and local sources is then inlined into the generated client code. No remote code execution occurs because JSDoc descriptions are escaped (a fix from prior CVEs), so the attack surface is restricted to information disclosure and SSRF; the fix requires opt-in with host allowlisting for remote resolution and directory-bound path resolution for local files.
Affected products
- Orval Labs Orval < 8.22.0
Timeline
- 2026-07-14: disclosed: Published to GitHub Advisory Database
- 2026-08-22: patched: Version 8.22.0 released with fix
- 2026-09-02: advisory: GitHub Advisory GHSA-cxq5-97v7-87j8 reviewed and published