Skip to content
OpenAdvisories

Package · npm

orval

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-62680

    Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

    Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-…

    orval-labs orval orval npm