Orval is a TypeScript client generator that processes OpenAPI specifications, and before version 8.22.0 it resolves external $ref values without restrictions. A crafted specification can cause the build host to fetch arbitrary remote resources or read absolute local files. This exposes internal network services and configuration files, yielding confidential data and potential unauthorized access. The issue involves insecure file access (CWE-22), server‑side request forgery (CWE-918), and the use of untrusted input (CWE-829).

The vulnerability applies to all releases of orval‑labs/orval prior to v8.22.0. Any developer workstation or CI pipeline that runs orval against an attacker‑controlled specification is at risk.

The CVSS score of 7.1 reflects a high severity exposure. EPSS information is not available and the vulnerability is not in the CISA KEV catalogue. Based on the description, it is inferred that the attack vector is supply‑chain based: the attacker must provide a malicious OpenAPI file that is parsed by orval, which is common when specifications are stored in public repositories or received from external contributors. Exploitation requires no elevated host privileges; it occurs during normal execution of the generator and therefore any environment where orval has network and file‑system access is potentially compromised.