CVE-2026-103036

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-103036
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103036.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-103036
Aliases
  • GHSA-4h5r-cv8j-4456
Published
2026-10-02T19:59:23Z
Modified
2026-10-04T02:46:18Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
@orpc/json-schema: Prototype injection in smart coercion
Details

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client that can reach a procedure with an object input schema can supply proto to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas and pass the coercer's satisfaction check. Attacker-controlled inherited properties can consequently affect handler, Object.assign, or configuration lookups, while legitimate proto properties are dropped. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and downstream schema validation still runs. This issue is fixed in version 1.14.9.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1321",
        "CWE-915"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103036.json"
}
References

Affected packages

Git / github.com/middleapi/orpc

Affected ranges

Type
GIT
Repo
https://github.com/middleapi/orpc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8a352622e756e8956311f5836cd5c5b9219c0666
Fixed
4dd5133c3a7597482021c8c9e9dffb4a06a8518c
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "1.14.9"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

@orpc/client@0.*
@orpc/client@0.0.2
@orpc/client@0.0.3
@orpc/client@0.0.4
@orpc/client@0.0.5
@orpc/client@0.0.6
@orpc/client@1.*
@orpc/client@1.0.0
@orpc/client@1.0.2
@orpc/client@2.*
@orpc/client@2.0.0
@orpc/contract@0.*
@orpc/contract@0.0.2
@orpc/contract@0.0.3
@orpc/contract@0.0.4
@orpc/contract@0.1.0
@orpc/contract@0.1.1
@orpc/contract@0.1.2
@orpc/contract@0.1.3
@orpc/openapi@0.*
@orpc/openapi@0.0.10
@orpc/openapi@0.0.11
@orpc/openapi@0.0.2
@orpc/openapi@0.0.3
@orpc/openapi@0.0.4
@orpc/openapi@0.0.6
@orpc/openapi@0.0.7
@orpc/openapi@0.0.8
@orpc/openapi@0.0.9
@orpc/react@0.*
@orpc/react@0.0.2
@orpc/react@0.0.3
@orpc/react@0.0.4
@orpc/react@0.0.5
@orpc/react@0.0.6
@orpc/react@0.0.7
@orpc/react@1.*
@orpc/react@1.0.0
@orpc/react@1.0.2
@orpc/react@2.*
@orpc/react@2.0.0
@orpc/server@0.*
@orpc/server@0.0.2
@orpc/server@0.0.3
@orpc/server@0.1.0
@orpc/server@0.1.2
@orpc/server@0.2.0
@orpc/server@0.2.1
@orpc/server@0.3.0
@orpc/server@0.3.1
@orpc/server@0.4.0
@orpc/shared@0.*
@orpc/shared@0.0.3
@orpc/shared@0.0.4
@orpc/shared@0.0.5
@orpc/shared@0.1.0
@orpc/shared@0.1.1
@orpc/transformer@0.*
@orpc/transformer@0.0.2
@orpc/transformer@0.0.3
@orpc/transformer@0.0.4
@orpc/transformer@0.0.5
@orpc/transformer@0.0.6
@orpc/zod@0.*
@orpc/zod@0.0.1
@orpc/zod@0.0.2
v0.*
v0.10.0
v0.10.0-beta.1
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.36.1
v0.37.0
v0.38.0
v0.39.0
v0.40.0
v0.41.0
v0.41.1
v0.41.2
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.45.1
v0.46.0
v0.47.0
v0.48.0
v0.49.0
v0.50.0
v0.51.0
v0.52.0
v0.53.0
v0.54.0
v0.6.0
v0.7.0
v0.8.0
v0.8.0-alpha.1
v0.8.0-alpha.2
v0.8.0-beta.1
v0.9.0
v0.9.0-beta.1
v1.*
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.3
v1.1.0
v1.1.1
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.13.0
v1.13.1
v1.13.10
v1.13.11
v1.13.12
v1.13.13
v1.13.14
v1.13.2
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.13.8
v1.13.9
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.14.4
v1.14.5
v1.14.6
v1.14.7
v1.14.8
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.7.0
v1.7.1
v1.7.10
v1.7.11
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-103036.json"