Orval is a tool that generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Before version 8.21.0, the function formatDefaultValue in packages/zod/src/index.ts improperly handles ${...} expressions or backticks in query parameter defaults by embedding them directly into module-level template literals without safe encoding. This flaw allows an attacker to inject JavaScript code that executes upon importing the generated zod schema module, resulting in remote code execution in environments such as development, continuous integration, testing, or applications using the generated code. The vulnerability is tracked as CWE-1336 and has a CVSS 4.0 score of 9.3, indicating critical severity. The issue is resolved in orval version 8.21.0.

Successful exploitation leads to arbitrary JavaScript code execution in the context of the developer, CI, test, or application environment that imports the generated zod schema module. This can compromise the integrity and security of these environments, potentially allowing attackers to execute malicious code without user interaction or privileges.

This vulnerability is fixed in orval version 8.21.0. Users and organizations should upgrade to version 8.21.0 or later to remediate this issue. Patch status is not explicitly stated beyond this fix version, so verifying the upgrade with the vendor advisory is recommended. No other mitigation or temporary workaround is indicated.