The vulnerability allows attacker-controlled JavaScript to be evaluated during the import of a generated zod schema module. An enumeration default value may contain a template literal such as ${…} or backticks that are emitted directly into a module‑level template literal without safe encoding. When this module is imported by a developer, CI, test runner, or application, the code inside the expression executes in the environment of the importer, leading to remote code execution. The weakness is identified by CWE-94 (Code Injection) and also involves poorly handled sensitive input as described by CWE-1336.

orval‑labs orval, any project using this library to generate client code from an OpenAPI or Swagger specification, prior to version 8.21.0. Projects that import the generated zod schema modules are at risk. All installations of orval before 8.21.0, regardless of the target framework or runtime, could be affected if they process malicious or tampered specification files.

The CVSS score of 9.3 marks this issue as critical, with a high likelihood of exploitation when an attacker supplies a malicious specification file. Although the EPSS score is not available, the absence of a CISA KEV listing does not reduce the urgency. The exploit does not require any privileged user account; it only needs the ability to provide an OpenAPI spec that includes a harmful enum default. Once imported, arbitrary code runs in the context of the importing process, creating a severe security risk.