A critical code injection vulnerability in Orval allows unauthenticated attackers to execute arbitrary code within the context of the generated client process.

This is a code injection vulnerability (CWE-94) occurring in the form-data serializer. The flaw allows an unauthenticated attacker to inject template literal expressions into OpenAPI schema property names, which are then executed as live code when the generated client builds FormData bodies.

Successful exploitation of this vulnerability results in arbitrary code execution with the privileges of the process running the generated client. This effectively grants an attacker full control over the client-side application environment, potentially leading to data exfiltration, unauthorized administrative actions, or total system compromise. Given the CVSS score of 9.8, this vulnerability presents an extreme risk to confidentiality, integrity, and availability.

Immediate Action: Update Orval to version 8.28.0 or later immediately to incorporate the necessary escaping logic for multipart property names.

Proactive Monitoring: Review application logs and build processes for anomalous FormData structures or unexpected input payloads that utilize template literal syntax.

Compensating Controls: Implement strict input validation on OpenAPI schemas to ensure property names do not contain special characters or template literal syntax before they are processed by the Orval generator.

Public Exploit Available: Yes — referenced in the official GitHub security advisory and associated pull request.

This is a critical vulnerability that requires immediate remediation. Development and security teams must prioritize updating the Orval dependency to version 8.28.0 across all projects to neutralize the injection vector. Failure to patch will leave applications exposed to trivial remote code execution attacks.