Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. In versions before 8.21.0, a double quote character in a header parameter name is directly emitted into the generated zod.object schema without proper encoding. This unsafe handling permits attacker-controlled JavaScript code to be evaluated during module import, leading to code execution in developer, CI, test, or application environments. The vulnerability affects the code in packages/zod/src/index.ts related to header request-validation generation. The vulnerability is identified as CWE-94 (Improper Control of Generation of Code) and is fixed in version 8.21.0.

Successful exploitation results in remote code execution without authentication in environments where the generated zod schema module is imported. This can compromise developer machines, continuous integration pipelines, testing environments, or applications using the vulnerable Orval-generated code. The CVSS 4.0 base score is 9.3 (critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Upgrade Orval to version 8.21.0 or later, where this code injection vulnerability is fixed by properly encoding double quotes in header parameter names during schema generation. No other mitigation is documented. Patch status is not explicitly stated in the vendor advisory, but the description confirms the issue is fixed in 8.21.0.