Orval is a code‑generation tool that produces type‑safe JavaScript clients from OpenAPI v3 or Swagger v2 specifications. In vulnerable releases prior to 8.21.0, the generator emits an unescaped backtick present in an OpenAPI path straight into JavaScript template literals used for constructing request URLs. This omission allows malicious JavaScript to be evaluated whenever the generated request, URL‑builder, or query‑key function is invoked, leading to remote code execution in the environment that consumes the client.

The impacted product is orval‑labs:orval. All releases before v8.21.0 embed a code‑generation path that fails to escape backticks in OpenAPI paths and outputs them directly into JavaScript template literals used by axios, fetch, react‑query, and SWR clients. Clients or applications that consume the generated code from these vulnerable releases are therefore exposed, especially if the OpenAPI specification contains attacker‑controlled backticks.

Based on the description, it is inferred that an attacker who can influence or host a malicious OpenAPI specification can cause the injected JavaScript to execute when the generated client code is called, allowing arbitrary code execution. The CVSS score of 9.3 indicates high severity; the EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog, which does not lower the risk. The most likely exploitation scenario occurs in development or CI environments where the client code is generated from untrusted specs, but a compromised production application that builds URLs from untrusted specifications could also be affected.