Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. In versions before 8.21.0, the function formatDefaultValue in packages/zod/src/index.ts emits ${...} expressions or backticks found in enum defaults directly into module-level template literals without safe encoding. This improper control of code generation (CWE-94) permits injection and evaluation of attacker-controlled JavaScript code upon import of the generated zod schema module, leading to code execution in environments where the module is used. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. The issue is resolved in orval version 8.21.0.

An attacker can inject and execute arbitrary JavaScript code in the context of the developer, continuous integration, testing, or application environment by crafting malicious enum default values that are processed by orval prior to version 8.21.0. This can lead to full code execution without requiring user interaction or privileges, posing a critical risk to the integrity and security of affected environments.

This vulnerability is fixed in orval version 8.21.0. Users should upgrade to version 8.21.0 or later to remediate this issue. Since no official patch links or advisories are provided, verify the upgrade through the vendor's official channels. No other mitigations are specified.