A double quote in a query parameter name can be emitted into the generated zod.object schema without proper encoding. When the generated schema module is imported, this causes attacker-controlled JavaScript to be evaluated, leading to code execution in environments such as a developer’s machine, CI pipelines, test harnesses, or the application runtime. The vulnerability is a form of improper encoding and code injection, corresponding to CWE‑116, CWE‑94, and CWE‑95.

The product affected is orval-labs' orval, which generates type‑safe JavaScript clients from OpenAPI or Swagger specifications. All releases prior to 8.21.0 are vulnerable, as the bug exists in the query request‑validation generation code in packages/zod/src/index.ts. Users of older orval versions that import the generated zod schemas are at risk.

The CVSS score of 9.3 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is import‑time exploitation: an attacker who can supply or modify an OpenAPI specification that contains a query parameter name with an embedded double quote can trigger arbitrary code execution when developers or CI systems import the generated zod validation module. Exploitation requires the attacker to influence the specification or the generation process; once the vulnerable module is loaded, the attacker gains full code execution in that environment.