Vulnerability · Published Mar 24, 2026 · Assigned by GitHub_M
CVE-2026-33331oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
High 8.2
In plain English
A high-severity cross-site scripting in orpc from middleapi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @orpc/openapi | 1.13.9 | GHSA-7f6v-3gx7-27q8 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
References
- https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8 x_refsource_CONFIRM
- https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add x_refsource_MISC
- https://github.com/middleapi/orpc/releases/tag/v1.13.9 x_refsource_MISC