CVE-2026-71865: Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

orval’s zod client emits each query parameter name as a double-quoted key in the generated zod.object({…}) request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({…}) runs – at MODULE IMPORT (export const OpQueryParams = zod.object({…}) executes on load) -> import-time RCE. The query parameter name is a pure data field. Verified on orval 8.19.0 / Node.