CVE-2026-33331: high-severity vulnerability in middleapi orpc
oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.3%
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Affected products
middleapi · orpcRelated CVEs — middleapi orpc
In the same product, most dangerous first.
CVE-2026-28794CRITICALoRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` DeserializationEPSS 1.1%CVE-2026-77360MEDIUMoRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS BypassEPSS 0.5%CVE-2026-103918MEDIUM@orpc/zod: Prototype injection in smart coercionEPSS 0.2%CVE-2026-103036MEDIUM@orpc/json-schema: Prototype injection in smart coercionEPSS 0.2%