Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. In versions prior to 8.21.0, the function formatDefaultValue in packages/zod/src/index.ts emits ${...} expressions or backticks in array item defaults directly into module-level template literals without safe encoding. This improper control of code generation (CWE-94) allows attacker-controlled JavaScript code to be evaluated upon importing the generated zod schema module, resulting in code execution in various environments such as developer machines, CI pipelines, testing, or applications. The vulnerability is addressed in orval version 8.21.0.

An attacker who can influence the OpenAPI or Swagger specification inputs that orval processes can inject arbitrary JavaScript code that executes when the generated zod schema module is imported. This leads to remote code execution in the environments where the generated code is used, potentially compromising developer systems, continuous integration pipelines, testing environments, or applications relying on the generated clients.

Upgrade orval to version 8.21.0 or later, where this vulnerability is fixed. There is no indication of alternative mitigations or temporary workarounds. Users should ensure they do not use vulnerable versions in their development or deployment pipelines.