Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Before version 8.21.0, an unescaped backtick character in an OpenAPI path is injected into URL template literals without proper encoding. This flaw exists in packages/core/src/getters/route.ts and related route generation code. It enables an attacker to inject and execute arbitrary JavaScript code when the generated request, URL-builder, or query-key functions are invoked, leading to code execution in environments such as developer machines, continuous integration pipelines, test environments, or applications using the generated clients. The vulnerability is identified as CWE-94 (Improper Control of Generation of Code) and related weaknesses CWE-116 and CWE-1336. The issue is resolved in orval version 8.21.0.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of the developer, CI, test, or application environment where the generated client code runs. This can lead to compromise of these environments, potentially affecting code integrity, confidentiality, and availability. The vulnerability has a CVSS 4.0 base score of 9.3 (critical), indicating high impact with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade orval to version 8.21.0 or later, where this vulnerability is fixed by properly escaping backticks in OpenAPI paths before generating URL template literals. No other official remediation or temporary fixes are indicated. Users should verify they are not using affected versions prior to 8.21.0.