High
oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Type: advisorySources: OSV
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-33331
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 02:16 UTC · Revision 1
Source evidence
oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
core-osv · Original sourcePublished 24 Mar 2026, 19:18 UTC
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.
osv:CVE-2026-33331
Complete source record
{
"id": "b48c569848e503701252ca4318bc11ead378a3d108cc2834fddecaa82fcde87a",
"url": "https://osv.dev/vulnerability/CVE-2026-33331",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify",
"summary": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.",
"evidence": "osv:CVE-2026-33331",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-33331",
"aliases": [
"CVE-2026-33331",
"GHSA-7f6v-3gx7-27q8"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/middleapi/orpc",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "267a406c43bad6bfe0ee3b03d6d6bfbd56b6539a"
},
{
"fixed": "4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:orpc:orpc:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "1.13.9"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "267a406c43bad6bfe0ee3b03d6d6bfbd56b6539a"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v1.13.9"
}
]
}
}
],
"versions": [
"v1.13.8",
"v1.13.7",
"v1.13.6",
"v1.13.5",
"v1.13.4",
"v1.13.2",
"v1.13.1",
"v1.13.0",
"v1.12.3",
"v1.12.2",
"v1.12.1",
"v1.12.0",
"v1.11.3",
"v1.11.2",
"v1.11.1",
"v1.11.0",
"v1.10.4",
"v1.10.3",
"v1.10.2",
"v1.10.1",
"v1.10.0",
"v1.9.4",
"v1.9.3",
"v1.9.2",
"v1.9.1",
"v1.9.0",
"v1.8.9",
"v1.8.8",
"v1.8.7",
"v1.8.6",
"v1.8.5",
"v1.8.4",
"v1.8.3",
"v1.8.2",
"v1.8.1",
"v1.8.0",
"v1.7.11",
"v1.7.10",
"v1.7.9",
"v1.7.8",
"v1.7.7",
"v1.7.6",
"v1.7.5",
"v1.7.4",
"v1.7.3",
"v1.7.2",
"v1.7.1",
"v1.7.0",
"v1.6.6",
"v1.6.5",
"v1.6.4",
"v1.6.3",
"v1.6.2",
"v1.6.1",
"v1.6.0",
"v1.5.2",
"v1.5.1",
"v1.5.0",
"v1.4.5",
"v1.4.4",
"v1.4.3",
"v1.4.2",
"v1.4.1",
"v1.4.0",
"v1.3.0",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.3",
"v1.0.0-beta.7",
"v0.54.0",
"v1.0.0-beta.6",
"v0.53.0",
"v1.0.0-beta.5",
"v0.52.0",
"v1.0.0-beta.4",
"v0.51.0",
"v1.0.0-beta.3",
"v0.50.0",
"v1.0.0-beta.2",
"v0.49.0",
"v0.48.0",
"v1.0.0-beta.1",
"v0.47.0",
"v0.46.0",
"v0.45.1",
"v0.45.0",
"v0.44.0",
"v0.43.0",
"v0.42.0",
"v0.41.2",
"v0.41.1",
"v0.41.0",
"v0.40.0",
"v0.39.0",
"v0.38.0",
"v0.37.0",
"v0.36.1",
"v0.36.0",
"v0.35.1",
"v0.35.0",
"v0.34.0",
"v0.33.0",
"v0.32.0",
"v0.31.0",
"v0.30.0",
"v0.29.0",
"v0.28.0",
"v0.27.0",
"v0.26.0",
"v0.25.0",
"v0.24.0",
"v0.23.0",
"v0.22.0",
"v0.21.0",
"v0.20.0",
"v0.19.0",
"v0.18.0",
"v0.17.0",
"v0.16.0",
"v0.15.0",
"v0.14.0",
"v0.13.0",
"v0.12.0",
"v0.11.0",
"v0.10.0",
"v0.10.0-beta.1",
"v0.9.0",
"v0.9.0-beta.1",
"v0.8.0",
"v0.8.0-beta.1",
"v0.8.0-alpha.2",
"v0.8.0-alpha.1",
"v0.7.0",
"v0.6.0",
"@orpc/server@0.4.0",
"@orpc/openapi@0.0.11",
"@orpc/zod@0.0.2",
"@orpc/transformer@0.0.6",
"@orpc/shared@0.1.1",
"@orpc/server@0.3.1",
"@orpc/react@0.0.7",
"@orpc/openapi@0.0.10",
"@orpc/contract@0.1.3",
"@orpc/client@0.0.6",
"@orpc/transformer@0.0.5",
"@orpc/shared@0.1.0",
"@orpc/server@0.3.0",
"@orpc/react@0.0.6",
"@orpc/openapi@0.0.9",
"@orpc/contract@0.1.2",
"@orpc/client@0.0.5",
"@orpc/server@0.2.1",
"@orpc/react@0.0.5",
"@orpc/openapi@0.0.8",
"@orpc/contract@0.1.1",
"@orpc/client@0.0.4",
"@orpc/server@0.2.0",
"@orpc/react@2.0.0",
"@orpc/openapi@0.0.7",
"@orpc/contract@0.1.0",
"@orpc/client@2.0.0",
"@orpc/server@0.1.2",
"@orpc/react@1.0.2",
"@orpc/openapi@0.0.6",
"@orpc/client@1.0.2",
"@orpc/zod@0.0.1",
"@orpc/transformer@0.0.4",
"@orpc/shared@0.0.5",
"@orpc/server@0.1.0",
"@orpc/react@1.0.0",
"@orpc/openapi@0.0.4",
"@orpc/contract@0.0.4",
"@orpc/client@1.0.0",
"@orpc/react@0.0.4",
"@orpc/transformer@0.0.3",
"@orpc/shared@0.0.4",
"@orpc/server@0.0.3",
"@orpc/react@0.0.3",
"@orpc/openapi@0.0.3",
"@orpc/contract@0.0.3",
"@orpc/client@0.0.3",
"@orpc/transformer@0.0.2",
"@orpc/shared@0.0.3",
"@orpc/server@0.0.2",
"@orpc/react@0.0.2",
"@orpc/openapi@0.0.2",
"@orpc/contract@0.0.2",
"@orpc/client@0.0.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33331.json"
}
}
],
"modified": "2026-10-28T02:30:25.299320650Z",
"provider": "osv",
"references": [
"https://github.com/middleapi/orpc/releases/tag/v1.13.9",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33331.json",
"https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8",
"https://nvd.nist.gov/vuln/detail/CVE-2026-33331",
"https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"
],
"provider_metadata": {
"cwe_ids": [
"CWE-79"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33331.json"
}
},
"related_cves": [
{
"value": "CVE-2026-33331",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 491846,
"published_at": "2026-03-24T19:18:00.164+00:00"
}