A critical code injection vulnerability in orval allows unauthenticated attackers to execute arbitrary JavaScript code by injecting a malicious operationId into an OpenAPI specification.

The vulnerability exists in the code generation logic where the operationId parameter is emitted into TanStack Query mutator options without sufficient sanitization. An unauthenticated attacker can supply a crafted operationId within an OpenAPI specification, resulting in the injection and subsequent execution of arbitrary JavaScript when the generated hooks are invoked.

Successful exploitation of this vulnerability allows for arbitrary code execution within the environment where the generated code is utilized. This could lead to a complete compromise of the client-side application, unauthorized access to sensitive data, or the redirection of user traffic. Given the CVSS score of 9.8, this flaw represents a critical risk to any system relying on automated code generation from untrusted OpenAPI sources.

Immediate Action: Update the orval package to version 8.29.0 or later immediately to incorporate the necessary escaping mechanisms.

Proactive Monitoring: Review CI/CD pipelines and code generation workflows to ensure that only trusted OpenAPI specifications are processed by the tool.

Compensating Controls: Implement strict input validation on all OpenAPI source files before they are passed to the orval generator to detect and block suspicious operationId values.

Public Exploit Available: No (exploit_available unknown)

This vulnerability presents a severe risk of arbitrary code execution and should be addressed as a high priority. Organizations using orval must upgrade to version 8.29.0 to remediate the underlying injection flaw. Failure to patch allows potential attackers to weaponize OpenAPI specifications to compromise applications that consume the generated code.