The vulnerability in orval before version 8.29.0 involves improper control of code generation, specifically a failure to escape OpenAPI media-type keys embedded in single-quoted Content-Type string literals. This enables attackers to craft OpenAPI specifications with malicious media-type keys that result in JavaScript code injection. The injected code executes in the context of generated fetch operations or mock resolvers, potentially leading to severe security consequences. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary JavaScript code in the context of the generated client code without any privileges or user interaction. This can lead to complete compromise of the client environment where the generated code is executed, affecting confidentiality, integrity, and availability of the system or data.

A fixed version of orval is available starting from version 8.29.0. Users should upgrade to orval 8.29.0 or later to remediate this vulnerability. Patch status is confirmed by the version range indicating affected versions are those before 8.29.0. No additional mitigations are specified.