The vulnerability arises from a failure to escape OpenAPI path values inside single-quoted route literals generated by the @orval/hono generator. An attacker can embed an apostrophe in a static path segment of a malicious OpenAPI document to inject arbitrary JavaScript code that will execute when the resulting TypeScript module is imported. This results in the ability to run unintended code during module load, potentially allowing full control over the environment in which the module runs.

All releases of orval from orval-labs prior to version 8.29.0 are affected. The product is the orval tool used to generate TypeScript clients and routers from OpenAPI specifications.

The CVSS score of 9.3 indicates a high severity flaw that permits code execution. Although the EPSS score is not available, the lack of known exploitation in the KEV catalog suggests no widespread exploitation yet, but the risk remains high due to the nature of the vulnerability. The likely attack vector involves an attacker providing or substituting a malicious OpenAPI document used during code generation. Once the generated module is imported in any application, the injected code will execute.