orval fails to escape the operationId field when generating metadata for TanStack Query mutator options. This flaw allows an attacker to embed arbitrary JavaScript within an OpenAPI specification so that the injected code executes whenever the generated hooks are invoked. The result is that malicious script runs in the user’s browser context, providing attackers with the full capabilities of a client‑side RCE.

The vulnerability affects the orval package from orval‑labs, specifically any version prior to 8.29.0. Users who generate TanStack Query hooks from OpenAPI files with untrusted operationId values are at risk.

The CVSS score of 9.3 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The attack vector is inferred to be the inclusion of a malicious operationId in an OpenAPI specification that an organization trusts and feeds to orval during code generation. If the specification is used in production code, the injected script could execute in the users’ browsers, potentially compromising data, session tokens, or allowing further attacks.