Orval generates type‑safe JavaScript clients from OpenAPI v3 and Swagger v2 specifications. In its MSW mock generator, a single quote in a schema property name is inserted directly into a single‑quoted object key without proper escaping, producing untrusted JavaScript that is later evaluated when the generated mock factory is called by tests or an MSW handler. This flaw allows an attacker who can supply a crafted OpenAPI specification to inject and execute arbitrary JavaScript in the environment that consumes the generated mock, such as a developer’s machine, a continuous‑integration pipeline or a running application. The vulnerability is a form of code injection, described by the listed CWEs (CWE‑89 and CWE‑95). The impact is full remote code execution with the privileges of the executing process, potentially exposing secrets, tampering with data, or disrupting availability.

The vulnerability affects the orval‑labs project named orval, specifically any release of the package prior to version 8.21.0. Users running pre‑8.21.0 builds of the orval library are at risk.

The CVSS score of 9.3 indicates a critical severity. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the ability of an attacker to insert a crafted property name containing a single quote into an OpenAPI specification, which then propagates into generated JavaScript that will be evaluated by the MSW mock. This scenario could be targeted by malicious contributors or by anyone who can supply an OpenAPI spec to a build system that uses orval for code generation.