CVE-2026-33331

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-33331
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33331.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-33331
Aliases
Published
2026-03-24T19:18:00.164Z
Modified
2026-04-10T05:42:46.663827Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N CVSS Calculator
Summary
oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Details

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.

Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33331.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/middleapi/orpc

Affected ranges

Type
GIT
Repo
https://github.com/middleapi/orpc
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
267a406c43bad6bfe0ee3b03d6d6bfbd56b6539a
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.13.9"
        }
    ]
}

Affected versions

@orpc/client@0.*
@orpc/client@0.0.2
@orpc/client@0.0.3
@orpc/client@0.0.4
@orpc/client@0.0.5
@orpc/client@0.0.6
@orpc/client@1.*
@orpc/client@1.0.0
@orpc/client@1.0.2
@orpc/client@2.*
@orpc/client@2.0.0
@orpc/contract@0.*
@orpc/contract@0.0.2
@orpc/contract@0.0.3
@orpc/contract@0.0.4
@orpc/contract@0.1.0
@orpc/contract@0.1.1
@orpc/contract@0.1.2
@orpc/contract@0.1.3
@orpc/openapi@0.*
@orpc/openapi@0.0.10
@orpc/openapi@0.0.11
@orpc/openapi@0.0.2
@orpc/openapi@0.0.3
@orpc/openapi@0.0.4
@orpc/openapi@0.0.6
@orpc/openapi@0.0.7
@orpc/openapi@0.0.8
@orpc/openapi@0.0.9
@orpc/react@0.*
@orpc/react@0.0.2
@orpc/react@0.0.3
@orpc/react@0.0.4
@orpc/react@0.0.5
@orpc/react@0.0.6
@orpc/react@0.0.7
@orpc/react@1.*
@orpc/react@1.0.0
@orpc/react@1.0.2
@orpc/react@2.*
@orpc/react@2.0.0
@orpc/server@0.*
@orpc/server@0.0.2
@orpc/server@0.0.3
@orpc/server@0.1.0
@orpc/server@0.1.2
@orpc/server@0.2.0
@orpc/server@0.2.1
@orpc/server@0.3.0
@orpc/server@0.3.1
@orpc/server@0.4.0
@orpc/shared@0.*
@orpc/shared@0.0.3
@orpc/shared@0.0.4
@orpc/shared@0.0.5
@orpc/shared@0.1.0
@orpc/shared@0.1.1
@orpc/transformer@0.*
@orpc/transformer@0.0.2
@orpc/transformer@0.0.3
@orpc/transformer@0.0.4
@orpc/transformer@0.0.5
@orpc/transformer@0.0.6
@orpc/zod@0.*
@orpc/zod@0.0.1
@orpc/zod@0.0.2
v0.*
v0.10.0
v0.10.0-beta.1
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.28.0
v0.29.0
v0.30.0
v0.31.0
v0.32.0
v0.33.0
v0.34.0
v0.35.0
v0.35.1
v0.36.0
v0.36.1
v0.37.0
v0.38.0
v0.39.0
v0.40.0
v0.41.0
v0.41.1
v0.41.2
v0.42.0
v0.43.0
v0.44.0
v0.45.0
v0.45.1
v0.46.0
v0.47.0
v0.48.0
v0.49.0
v0.50.0
v0.51.0
v0.52.0
v0.53.0
v0.54.0
v0.6.0
v0.7.0
v0.8.0
v0.8.0-alpha.1
v0.8.0-alpha.2
v0.8.0-beta.1
v0.9.0
v0.9.0-beta.1
v1.*
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.0-beta.5
v1.0.0-beta.6
v1.0.0-beta.7
v1.0.3
v1.1.0
v1.1.1
v1.10.0
v1.10.1
v1.10.2
v1.10.3
v1.10.4
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.12.0
v1.12.1
v1.12.2
v1.12.3
v1.13.0
v1.13.1
v1.13.2
v1.13.4
v1.13.5
v1.13.6
v1.13.7
v1.13.8
v1.2.0
v1.3.0
v1.4.0
v1.4.1
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.5.0
v1.5.1
v1.5.2
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.6.4
v1.6.5
v1.6.6
v1.7.0
v1.7.1
v1.7.10
v1.7.11
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.7.7
v1.7.8
v1.7.9
v1.8.0
v1.8.1
v1.8.2
v1.8.3
v1.8.4
v1.8.5
v1.8.6
v1.8.7
v1.8.8
v1.8.9
v1.9.0
v1.9.1
v1.9.2
v1.9.3
v1.9.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33331.json"