Import-time code execution via unescaped enum default

Code injection in Orval before 8.21.0 allows attackers to execute JavaScript at import time via crafted enum default values in OpenAPI input. In packages/zod/src/index.ts, the formatDefaultValue function emits enum-typed default values into a module-level template literal during zod schema generation without escaping ${...} or backticks, so attacker input becomes a live JavaScript expression in the generated module. Exposure requires generation and later import of a zod schema module from an attacker-controlled or attacker-influenced specification; execution then occurs in the developer workstation, CI job, test runner, or application process that imports it.