This vulnerability allows an attacker to inject arbitrary JavaScript into the code generated by Orval. By supplying specially crafted values in the x‑enum‑descriptions field of an OpenAPI specification, the unsanitized string builder can be made to produce a JSFuck expression that bypasses the existing escape logic. The resulting injected code is then executed in the context where the generated client is used, potentially yielding full control of the application running the client. The flaw is a classic code‑injection weakness (CWE‑94) and can compromise confidentiality, integrity, and availability if the generated code is deployed in a trusted environment.

The affected product is Orval from orval-labs. Versions 7.19.0 through 7.20.x and 8.0.0 through 8.1.x are vulnerable, as these released before the comprehensive fix that appears in 7.21.0 and 8.2.0. All earlier or later releases are not impacted unless they contain the same escape logic.

The CVSS v3.1 base score of 9.3 indicates high severity, while the EPSS score of less than 1% shows a very low likelihood that the flaw is being exploited in the wild at present. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker who can supply or influence a malformed OpenAPI specification that is processed by Orval, such as a compromised CI pipeline or malicious code generator. Once the vulnerable code is generated, arbitrary JavaScript can run in the browser or Node.js environment where the client is loaded.