SSRF and file inclusion via unrestricted $ref

Improper external $ref resolution in Orval before 8.22.0 allows attackers to read local files and trigger build-host SSRF via crafted specs. In packages/orval/src/import-specs.ts, the external reference loader fetched remote URLs and read local file paths named in external $ref values without an allowlist or confinement to the input spec directory, then inlined that content into generated clients. Exploitation requires a developer workstation or CI job to run Orval on an attacker-controlled or attacker-influenced OpenAPI document, and the published advisory bounds the impact to network requests, file reads, and untrusted schema inclusion rather than code execution.