The vulnerability in orval prior to version 8.29.0 involves improper control of code generation. Specifically, the operationId parameter is emitted without escaping into the generated TanStack Query mutator options metadata objects. An attacker can craft an OpenAPI specification with a malicious operationId that injects arbitrary JavaScript code. This code executes when the generated hooks from orval are invoked, leading to potential remote code execution or other malicious behaviors.

Successful exploitation allows an attacker to execute arbitrary JavaScript code in the context of the application using orval-generated hooks. This can lead to severe consequences such as remote code execution, data manipulation, or compromise of application integrity. The CVSS 4.0 score of 9.3 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

A fix is available in orval version 8.29.0. Users should upgrade to version 8.29.0 or later to remediate this vulnerability. Until then, avoid using untrusted OpenAPI specifications with orval-generated hooks. Patch status is confirmed by the versioning information indicating the vulnerability affects versions before 8.29.0.