The vulnerability resides in the way orval handles media-type keys within OpenAPI specifications. These keys are inserted into single-quoted Content-Type string literals in the generated code without proper escaping. If an attacker supplies a crafted media-type key, the resulting JavaScript code is executed when the generated fetch operation or mock resolver runs. This flaw is a classic code-injection problem (CWE-94) that can lead to remote code execution in the environment where the generated code is executed.

All releases of orval produced by orval-labs prior to version 8.29.0 are affected. The product is the orval command-line tool that generates client code from OpenAPI specifications. Any system that uses orval to generate fetch libraries or mock servers from a spec containing unescaped media-type keys is at risk until the code is regenerated with a patched version.

The CVSS score of 9.3 reflects the high impact and requirement for the attacker to supply a malicious OpenAPI document. The EPSS score is unavailable but the lack of KEV listing does not diminish the intrinsic severity. Attackers can achieve arbitrary JavaScript execution by crafting media-type values in a specification that an organization feeds to orval, causing the generated code to execute the payload upon use. Consequently, the exposure risk remains high until the environment is patched or the input sanitized.