Orval, a generator of type‑safe JavaScript clients from OpenAPI or Swagger documents, contains a flaw that allows arbitrary code evaluation when a default value in an array item of the specification contains a ${…} expression or backtick. The bad value is emitted directly into a module‑level template literal used by the zod schema generator without any encoding. When the generated zod schema module is imported, the templated JavaScript runs, giving the attacker remote code execution in the developer, CI, test or application environment. This vulnerability is exercised by the CWE‑94 (Code Injection), CWE‑116 (Improper Encoding), and CWE‑1336 (Unsafe Deserialization) weaknesses and can compromise confidentiality, integrity, and availability of the affected system.

The risk applies to any project that uses orval‑labs:orval to generate client code. Versions of the package older than 8.21.0 are vulnerable. Updating the generator to 8.21.0 or a later release removes the unescaped template literal emission.

The CVSS score of 9.3 indicates a high‑severity risk. Exploitation requires the attacker to supply a malicious OpenAPI specification that contains an array default with a ${…} expression or backtick, and then have the generated client module imported in a runtime that executes the template literal. There is no public exploitation evidence (EPSS not available and it is not listed in CISA KEV). However, if an organization imports generated code from untrusted sources, the potential for code execution exists and the risk warrants immediate attention.