Orval generates type-safe JavaScript clients from OpenAPI specifications. Prior to release 8.21.0, a "double quote" in a header parameter name was inserted verbatim into a generated Zod validation schema. Because the schema is evaluated when the module is imported, the unescaped double quote allows attacker-controlled JavaScript to be injected and executed in the environment that imports the client. Based on the description, it is inferred that the vulnerability permits code injection when a malicious OpenAPI specification includes such a header name, leading to remote code execution with the privileges of the importing process.

The issue affects the orval‑labs/orval JavaScript client generator package. Any installed version of orval older than 8.21.0 is vulnerable. The vulnerability is not limited to a single platform; it can impact development machines, continuous‑integration pipelines, test environments, or any application that imports the generated client code.

The CVSS score of 9.3 indicates a high‑severity remote code execution flaw. The EPSS score is not available, which suggests that, while the potential for exploitation exists, the public exploitation probability may be low due to the specialized nature of the tool. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is an attacker supplying a malicious OpenAPI specification containing a header parameter name with an unescaped double quote; the resulting generated Zod schema will execute arbitrary JavaScript when imported. The attack requires that the generated client code be imported in a Node or browser context, which is typical during development or continuous integration. Consequently, the overall risk to systems that use orval without upgrading is significant.