An unescaped backtick in the servers[0].url field of an OpenAPI specification is emitted directly into a request‑URL template literal when the getBaseUrlFromSpecification helper is enabled. When the generated route function or URL‑builder is called, the literal is evaluated as JavaScript, allowing an attacker‑controlled string to be executed. This flaw can compromise the developer’s machine, continuous‑integration servers, test environments, or the application itself, exposing confidential data or allowing further lateral movement. The weakness arises from improper input validation and unsafe string concatenation, corresponding to the identified issues of CWE‑94 (Code Injection), CWE‑116 (Improper Encoding or Escaping), and CWE‑1336 (Insecure Direct Object References).

The vulnerability is present in the orval‑labs orval package prior to version 8.21.0. The affected code resides in packages/core/src/getters/route.ts within the getFullRoute function. Any system that generates a type‑safe JavaScript client from an OpenAPI v3 or Swagger v2 specification using the vulnerable version is impacted, regardless of whether the client runs in a browser, Node.js environment, or a CI pipeline.

The CVSS score of 9.3 indicates a critical severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker who can supply or modify the OpenAPI specification (for example, via a public API gateway or a code‑integration pipeline) can trigger the exploitation by including an unescaped backtick in the servers[0].url value, which is then executed when the generated client function is invoked. Because the flaw is introduced during code generation rather than during runtime, no additional persistent changes to the client runtime environment are required for exploitation.