Orval OpenAPI $ref Resolver SSRF and File Inclusion

Orval versions prior to 8.22.0 are susceptible to an information disclosure and SSRF vulnerability due to insecure handling of $ref pointers within OpenAPI specifications. During the generation process, Orval fetches remote HTTP(S) resources and reads arbitrary local files (including out-of-tree and absolute paths) to inline schema components. An attacker who provides a malicious OpenAPI specification can force the build host (developer machine or CI/CD environment) to perform unauthorized network requests or read sensitive files from the local filesystem.

While previous vulnerabilities in Orval allowed for output injection (RCE), the current implementation includes escaping for JSDoc descriptions, mitigating the risk of code execution. However, the ability to read arbitrary files and include remote schemas remains, leading to potential credential or configuration leakage from the build environment. The vendor has released a fix in version 8.22.0, which restricts $ref resolution to the local directory tree and disables remote resolution by default, requiring an opt-in allowlist.

Impact

Successful exploitation results in build-time SSRF, unauthorized disclosure of sensitive local files, and inclusion of untrusted remote content into generated client code. This impacts development environments and automated CI/CD pipelines, potentially exposing secrets, environment variables, or private source code to unauthorized parties or internal infrastructure if accessed via SSRF.

Recommendation

• Upgrade Orval to version 8.22.0 or later across all development and CI/CD environments.
• Audit existing OpenAPI specifications used in build processes to ensure $ref fields point only to trusted, local sources within the project tree.
• Implement egress filtering for CI/CD build agents to prevent unexpected outbound connections initiated by build tools like Orval.
• Review build logs for anomalous HTTP requests or unexpected file access patterns originating from the orval process.