The vulnerability in orval/core allows injected expressions inside OpenAPI schema property names to be executed when the client code is generated. The serializer fails to escape multipart property names in generated template literals, enabling an attacker to embed `${...}` expressions that interpolate at build time, leading to arbitrary code execution with the privileges of the consumer process.

All installations of the orval/labs/orval product using orval/core prior to version 8.28.0 are affected. The issue exists in all releases of orval/core with versions earlier than 8.28.0 regardless of the environment in which the client is generated.

The CVSS score of 9.3 classifies this as a critical flaw. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers are likely to exploit this flaw by introducing a malicious OpenAPI schema that contains crafted property names with `${...}` expressions into a build pipeline or a developer’s local environment. Once the client is generated and the FormData bodies are constructed in the consumer process, the malicious code will execute with the rights of that process, potentially compromising the entire build or runtime environment.