Orval produces type‑safe TS clients from OpenAPI specs. In vulnerable versions the const keyword on schema properties is interpolated directly into mock files without proper escaping, allowing a malicious OpenAPI to inject arbitrary TypeScript or JavaScript. The injected code ends up in the generated interfaces and MSW handlers; when these mocks are imported or executed, the attacker’s code runs. The likely attack vector is an attacker supplying a crafted OpenAPI file during the build or CI process, which is not explicitly stated in the CVE but inferred from the description.

The vulnerability affects the Orval library from orval‑labs. Versions 7.19.0 and all earlier releases, as well as 8.0.0‑rc.0 through 8.0.2, are impacted. The issue is resolved in 7.20.0 and later, and in 8.0.3 and later. No other vendors or versions are affected.

CVSS score 7.7 indicates a high severity. The EPSS score is less than 1 %, signalling a low expected exploitation frequency. It is not listed in CISA’s KEV catalog. Exploitation requires a build‑time or CI system that processes untrusted OpenAPI documents. If an attacker can control the spec fed to Orval, the injected code is generated and will run in any runtime that imports the mock modules. Because the flaw manifests during code generation, it must be mitigated at development or build time rather than at application runtime.