CVE-2026-28794

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28794", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T14:25:19.245Z", "datePublished": "2026-03-06T05:02:19.019Z", "dateUpdated": "2026-03-09T19:53:35.764Z"}, "containers": {"cna": {"title": "oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc"}, {"name": "https://github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5", "tags": ["x_refsource_MISC"], "url": "https://github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5"}], "affected": [{"vendor": "middleapi", "product": "orpc", "versions": [{"version": "< 1.13.6", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T05:02:19.019Z"}, "descriptions": [{"lang": "en", "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6."}], "source": {"advisory": "GHSA-m272-9rp6-32mc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-09T19:53:21.791713Z", "id": "CVE-2026-28794", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:53:35.764Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28794", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-09T19:53:21.791713Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-09T19:53:31.304Z"}}], "cna": {"title": "oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization", "source": {"advisory": "GHSA-m272-9rp6-32mc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.3, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "middleapi", "product": "orpc", "versions": [{"status": "affected", "version": "< 1.13.6"}]}], "references": [{"url": "https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc", "name": "https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5", "name": "https://github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T05:02:19.019Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28794", "state": "PUBLISHED", "dateUpdated": "2026-03-09T19:53:35.764Z", "dateReserved": "2026-03-03T14:25:19.245Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-06T05:02:19.019Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "orpc", "vendor": "middleapi", "versions": [{"status": "affected", "version": "< 1.13.6"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:orpc:orpc:*:*:*:*:*:*:*:*", "matchCriteriaId": "D29E8AD1-8425-4A68-BD81-0830EF0205E9", "versionEndExcluding": "1.13.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6."}, {"lang": "es", "value": "oRPC es una herramienta que ayuda a construir APIs que son de tipo seguro de extremo a extremo y se adhieren a los est\u00e1ndares OpenAPI. Antes de la versi\u00f3n 1.13.6, existe una vulnerabilidad de contaminaci\u00f3n de prototipos en el deserializador JSON RPC del paquete @orpc/client. La vulnerabilidad permite a atacantes remotos no autenticados inyectar propiedades arbitrarias en el Object.prototype global. Debido a que esta contaminaci\u00f3n persiste durante la vida \u00fatil del proceso Node.js y afecta a todos los objetos, puede conducir a graves brechas de seguridad, incluyendo omisi\u00f3n de autenticaci\u00f3n, denegaci\u00f3n de servicio y potencialmente ejecuci\u00f3n remota de c\u00f3digo. Este problema ha sido parcheado en la versi\u00f3n 1.13.6."}], "id": "CVE-2026-28794", "lastModified": "2026-06-17T10:29:03.437", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28794", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-09T19:53:21.791713Z", "version": "2.0.3"}}]}, "published": "2026-03-06T05:16:40.297", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.13.6)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "orpc", "source": "cna", "vendor": "middleapi"}, "product": "orpc", "vendor": "middleapi"}], "analysis": {"en": {"generated_at": "2026-04-16T11:32:50.393083+00:00", "value": {"mitigation_remediation": ["Upgrade @orpc/client to v1.13.6 or newer.", "Ensure that all dependencies and transitive packages use the patched version; update package-lock.json and rebuild the application.", "Apply strict input validation to RPC payloads, or switch to a safer serializer that does not perform untrusted deserialization, to guard against prototype pollution if upgrading is not immediately possible."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Any Node.js application that imports the @orpc/client library from the middleapi:orpc vendor and runs a version older than 1.13.6 is affected. This includes direct usage in user code, indirect usage through other packages, or any server that processes untrusted RPC requests through the vulnerable serializer.", "description_and_impact": "oRPC is an API toolkit that relies on JSON serialization for RPC calls. Prior to version 1.13.6, the @orpc/client package contained a prototype pollution flaw in its StandardRPCJsonSerializer. An attacker could send a specially crafted JSON payload that would be deserialized into the client\u2019s runtime and inject arbitrary properties into the global Object.prototype. Because the polluted prototype persists for the remainder of the Node.js process, the instance becomes vulnerable to subsequent misuse. This flaw can be leveraged for authentication bypass, denial\u2011of\u2011service, and potentially Remote Code Execution, depending on how the polluted properties interact with application logic.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is listed as less than 1%, suggesting that widespread exploitation is currently unlikely, and it is not present in the CISA KEV catalog. Nevertheless, the attack vector is remote and unauthenticated, and exploitation only requires an attacker to deliver a malicious JSON payload over any channel that the RPC service accepts. Once executed, the injection can persist for the lifetime of the process, making the risk long\u2011lasting. Administrators should treat this flaw with the same urgency as any remote code execution vulnerability."}}}}, "created": "2026-03-06T14:55:38.956714+00:00", "updated": "2026-04-16T11:45:26.260430+00:00", "vendors": ["middleapi", "middleapi$PRODUCT$orpc"]}