Orval, a tool that generates type‑safe JavaScript clients from OpenAPI specifications, contains an import‑time vulnerability that allows attacker‑controlled JavaScript to be evaluated when a generated zod schema module is imported. The flaw stems from unescaped template literals or ${...} expressions in schema default values that are emitted into a module‑level template literal in the zod schema generator. The affected code path is the formatDefaultValue function in packages/zod/src/index.ts, and execution of malicious JavaScript in the developer, CI, test, or application environment results in code execution with the privileges of the executing process.

Any project that uses orval‑labs/orval to generate clients from OpenAPI or Swagger specifications is affected, particularly those employing versions prior to 8.21.0. The vulnerability applies to all environments where the generated code is imported, including local development, continuous integration pipelines, or deployed applications.

The CVSS score of 9.3 categorises this issue as critical, and the EPSS score is not available for this vulnerability. It is not listed in the CISA KEV catalog, but the lack of a false‑positive mitigation means the risk remains high until patched. Attackers can target the supply chain by modifying an OpenAPI spec supplied to orval; during import the resulting zod schema module will execute arbitrary JavaScript in the context of the importing process.