Orval generates type-safe JavaScript clients from OpenAPI and Swagger specifications. Before version 8.21.0, the function formatDefaultValue in packages/zod/src/index.ts improperly handles ${...} expressions or backticks in schema defaults by embedding them directly into module-level template literals without safe encoding. This flaw allows attacker-controlled JavaScript code to be executed upon importing the generated zod schema module, resulting in code execution in various environments such as development, continuous integration, testing, or runtime application contexts. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and related CWEs. It is fixed in version 8.21.0.

An attacker who can influence schema defaults can inject arbitrary JavaScript code that will be executed when the generated zod schema module is imported. This leads to remote code execution in the developer, CI, test, or application environment, potentially compromising the affected systems. The vulnerability has a CVSS 4.0 score of 9.3 (critical), reflecting its high impact and ease of exploitation without privileges or user interaction.

This vulnerability is fixed in orval version 8.21.0. Users should upgrade to version 8.21.0 or later to remediate this issue. No other official remediation or temporary fixes are documented. Until upgrading, avoid importing generated modules from untrusted or attacker-controlled schema defaults.