Orval, a tool that produces type‑safe JavaScript clients from OpenAPI specifications, can emit a module‑level template literal that contains an unescaped `${...}` expression or backtick from a query‑parameter default. When an attacker supplies a malicious value for that default, the resulting zod schema module is imported and the JavaScript is evaluated, allowing arbitrary code to run in the environment that imports the generated client. This is a direct code‑execution flaw and is identified as CWE‑1336.

The vulnerability affects the Orval package by orval‑labs, specifically in versions prior to 8.21.0. The issue resides in packages/zod/src/index.ts in the formatDefaultValue function. Users who generate clients from OpenAPI v2 or v3 specifications that include a query‑parameter default containing backticks or `${…}` therefore produce unsafe code.

With a CVSS score of 9.3, the flaw is considered high severity. The EPSS score is not available, so current data does not indicate an active exploitation trend, and the vulnerability is not listed in CISA’s KEV catalog. Nevertheless, the attack vector is straightforward: an adversary who controls an OpenAPI spec can embed malicious defaults. When the generated zod schema module is later imported—such as during development, CI pipelines, or in a deployed application—the unescaped expression is evaluated and remote code is executed. The flaw requires code generation into a project but does not require any special privileges within that project once the module is imported.