orval 8.14.0 through 8.28.1 contains a code injection flaw in the @orval/effect generator that turns OpenAPI schema defaults containing the ${…} syntax into JavaScript template literals. When the generated code is built or imported, the embedded JavaScript expressions are evaluated at module scope, allowing arbitrary JavaScript execution that can compromise the runtime environment.

The affected product is orval-labs’ orval package, specifically the @orval/effect component. Versions 8.14.0 through 8.28.1 are impacted. The vulnerability is present in any environment that uses these versions to generate client code from OpenAPI schemas, such as CI pipelines, build servers, or local development setups that compile the library.

The CVSS score of 9.3 reflects a high severity. EPSS data is not available, but the lack of currently known exploits does not reduce the risk, because an attacker who can supply a malicious OpenAPI file can trigger the vulnerability whenever the code is compiled or imported. The attack likely requires the attacker to provide a crafted schema to the build or runtime environment; it is not an active remote code execution over a network, but it is still a local or remote code execution depending on how the build server is exposed. The vulnerability is not listed in CISA KEV, but the severity and potential impact warrant immediate action.