A critical code injection vulnerability in the orval OpenAPI generator allows unauthenticated attackers to execute arbitrary JavaScript during the build or import process.

The vulnerability exists within the @orval/effect generator, which improperly handles OpenAPI schema defaults by converting them into template literals. This allows an attacker to inject JavaScript expressions using ${...} syntax, which are subsequently executed at the module scope when the generated code is built or imported.

Successful exploitation of this vulnerability can result in full remote code execution within the environment where the generated code is processed. Given the CVSS score of 9.8, this flaw poses a critical risk to the software supply chain, as it could allow attackers to compromise build pipelines, exfiltrate sensitive environment variables, or inject persistent backdoors into downstream applications.

Immediate Action: Update orval-labs orval to version 8.29.0 or higher immediately.

Proactive Monitoring: Audit build logs and CI/CD pipeline execution logs for unusual activity or unauthorized file modifications during the generation phase.

Compensating Controls: Ensure that OpenAPI schema files are sourced only from trusted, internal origins and implement strict input validation on all schema definitions to prevent the inclusion of malicious template literal syntax.

Public Exploit Available: Unknown.

This is a critical vulnerability that requires immediate attention. Organizations utilizing orval to generate code from OpenAPI specifications must prioritize upgrading to version 8.29.0 to eliminate the injection vector. Failure to patch this issue could lead to a complete compromise of the development environment and the integrity of the resulting software artifacts.