A malicious OpenAPI specification that contains an unsanitized x-enumDescriptions field can inject executable TypeScript or JavaScript into the output of Orval’s client generation. The injected code is emitted directly in the generated enum implementation files, allowing an attacker to execute arbitrary instructions when the generated client is used. This flaw is rooted in improper input handling—specifically command injection (CWE‑77) and code execution via unsanitized dynamic code (CWE‑94). The primary impact is code execution in any environment that consumes the vulnerable client code.

The vulnerability affects orval-labs’ Orval product, specifically versions older than 7.19.0 and any releases before 8.0.2. 7.19.0 and 8.0.2 contain the fix, so any system using a version older than these fixed releases is susceptible.

The CVSS score of 9.3 classifies this flaw as a high‑severity vulnerability. EPSS indicates a very low exploitation probability (<1%), and it is currently not listed in CISA’s KEV catalog. However, the attack requires an attacker to supply a crafted OpenAPI spec to the Orval build process, which typically occurs in continuous integration pipelines or build scripts. If such a spec is executed, the attacker could gain arbitrary code execution within the build environment or any host that interprets the generated client.