CVE-2026-33331 json
oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
published 2026-03-20 7 mo ago modified 2026-06-17 4 mo ago also GHSA-7f6v-3gx7-27q8 , EUVD-2026-20085
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.
Patch / fix
- npm @orpc/openapi 1.13.9
- orpc orpc 1.13.9
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | @orpc/openapi | <1.13.9 |
1.13.9 |
Affected products
- middleapi orpc
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add
web, patch
-
github.com
/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8
exploit, web, mitigation, vendor-advisory
-
github.com
/middleapi/orpc/releases/tag/v1.13.9
web, product, release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-33331
advisory
-
github.com
/middleapi/orpc
package
Sources
- CVE List CVE-2026-33331
- GitHub Advisory GHSA-7f6v-3gx7-27q8
- NVD CVE-2026-33331
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.