Orval’s code generator, between versions 8.19.0 and 8.21.0, emits a double quote from an OpenAPI property name directly into the generated zod.object({...}) schema without escaping. When a developer, CI pipeline, or application imports the resulting Zod schema module, the unescaped string is evaluated as JavaScript code, giving an attacker the ability to execute arbitrary code in the import context. This flaw is a code‑injection weakness (CWE‑95) that triggers during module import.

The vulnerability affects projects that use orval‑labs:orval to generate Zod clients between the versions 8.19.0 and 8.21.0. Any environment that imports the generated schema—development machines, continuous‑integration servers, test harnesses, or running applications—can be compromised. The issue is fixed in orval v8.21.0 and later releases.

The CVSS score of 9.3 denotes critical severity. No EPSS score is reported, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a publicly disclosed exploit does not lessen the inherent risk. An attacker only needs to supply a malicious OpenAPI specification that includes a double quote in a property name; once that specification is processed by the vulnerable version, the resulting client module can be imported somewhere in the attacker’s control, causing code execution with the privileges of the importing process.