The orval package before version 8.28.0 contains a code injection vulnerability due to improper escaping of multipart property names in the form-data serializer. Attackers can inject ${...} expressions into OpenAPI schema property names, which are then executed as live interpolations when the generated client builds FormData bodies. This vulnerability allows code execution in the context of the consumer process, posing a critical security risk.

Successful exploitation enables an attacker to execute arbitrary code with the privileges of the process generating the client, potentially leading to full compromise of the affected environment. The vulnerability is remotely exploitable without authentication and requires no user interaction, increasing its severity.

Upgrade orval to version 8.28.0 or later where this vulnerability is fixed. Patch status is confirmed by the versioning information indicating the fix in 8.28.0. Until upgrading, avoid processing untrusted OpenAPI schemas that could contain malicious property names.