Orval is a tool that generates type‑safe JavaScript client code from OpenAPI/Swagger specifications. Before version 8.21.0, a header parameter default that contained a backtick or a ${…} expression was emitted directly into a module‑level template literal in the generated Zod schema. The injected text is evaluated when the schema module is imported, giving an attacker the ability to run arbitrary JavaScript in the environment that imports the file. This constitutes a remote code execution vulnerability that can affect developers, continuous‑integration pipelines, testing environments and end‑user applications. The weakness involves code injection, unsafe string handling and improper input sanitisation, reflected by CWE‑94, CWE‑116 and CWE‑1336.

The only affected product is orval, a package maintained by orval‑labs. Versions of the orval CLI prior to 8.21.0 are vulnerable. Current releases from 8.21.0 onward contain a patch that removes unsafe template literal emission.

The vulnerability has a CVSS base score of 9.3, rating it as critical. The EPSS score is not available, but the lack of listing in the CISA KEV catalog suggests no current widespread exploitation reports. Attacker feasibility is high: the exploit requires the ability to supply a malicious OpenAPI spec where the header default contains a backtick or ${…} expression; once a developer or build system generates the Zod schema and the resulting module is imported, code execution occurs. The impact is complete code‑execution privilege in the importing process, with potential takeover of the CI environment, development machine or the deployed application.