CVE-2026-33331: falha de alta gravidade em middleapi orpc
oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.2epss 0.3%
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Produtos afetados
middleapi · orpcCVEs relacionadas — middleapi orpc
No mesmo produto, das mais perigosas para as menos.
CVE-2026-28794CRITICALoRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` DeserializationEPSS 1.1%CVE-2026-77360MEDIUMoRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS BypassEPSS 0.5%CVE-2026-103918MEDIUM@orpc/zod: Prototype injection in smart coercionEPSS 0.2%CVE-2026-103036MEDIUM@orpc/json-schema: Prototype injection in smart coercionEPSS 0.2%