Orval versions before 8.29.0 are vulnerable to a critical code injection flaw that allows unauthenticated attackers to execute arbitrary code during the TypeScript generation process.

The vulnerability exists within the @orval/hono generator, which fails to properly sanitize OpenAPI path values when creating single-quoted route literals. An unauthenticated attacker can craft a malicious OpenAPI document containing an apostrophe in a static path segment, causing the generator to inject arbitrary JavaScript that executes upon importing the generated TypeScript module.

The ability to inject arbitrary code during the build or generation process poses a severe risk to the software supply chain. Successful exploitation could lead to full system compromise, unauthorized data access, or the introduction of backdoors into production applications. Given the CVSS score of 9.8, this vulnerability represents a critical threat that could result in significant operational disruption and loss of intellectual property.

Immediate Action: Update the orval package to version 8.29.0 or later immediately to incorporate the necessary escaping logic for route literals.

Proactive Monitoring: Audit existing OpenAPI documents and generated TypeScript modules for suspicious characters or unexpected code patterns in route definitions.

Compensating Controls: Implement strict input validation for any OpenAPI documents processed by your build pipeline and ensure that the generation process runs in an isolated, low-privilege environment.

Public Exploit Available: No

This vulnerability is classified as critical due to the potential for remote code execution via a manipulated OpenAPI specification. Organizations utilizing the orval library for TypeScript generation must prioritize updating to version 8.29.0 to remediate the underlying code injection flaw. Failure to patch this issue could allow attackers to weaponize the build pipeline, leading to persistent compromise of the generated application code.