CVE-2026-33331

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33331", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-18T22:15:11.811Z", "datePublished": "2026-03-24T19:18:00.164Z", "dateUpdated": "2026-03-25T13:34:26.196Z"}, "containers": {"cna": {"title": "oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"}, {"name": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add", "tags": ["x_refsource_MISC"], "url": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"}, {"name": "https://github.com/middleapi/orpc/releases/tag/v1.13.9", "tags": ["x_refsource_MISC"], "url": "https://github.com/middleapi/orpc/releases/tag/v1.13.9"}], "affected": [{"vendor": "middleapi", "product": "orpc", "versions": [{"version": "< 1.13.9", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T19:18:00.164Z"}, "descriptions": [{"lang": "en", "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9."}], "source": {"advisory": "GHSA-7f6v-3gx7-27q8", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T13:34:21.265192Z", "id": "CVE-2026-33331", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:34:26.196Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33331", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T13:34:21.265192Z"}}}], "references": [{"url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T13:34:14.962Z"}}], "cna": {"title": "oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify", "source": {"advisory": "GHSA-7f6v-3gx7-27q8", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "middleapi", "product": "orpc", "versions": [{"status": "affected", "version": "< 1.13.9"}]}], "references": [{"url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8", "name": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add", "name": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/middleapi/orpc/releases/tag/v1.13.9", "name": "https://github.com/middleapi/orpc/releases/tag/v1.13.9", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-24T19:18:00.164Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33331", "state": "PUBLISHED", "dateUpdated": "2026-03-25T13:34:26.196Z", "dateReserved": "2026-03-18T22:15:11.811Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-24T19:18:00.164Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "orpc", "vendor": "middleapi", "versions": [{"status": "affected", "version": "< 1.13.9"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:orpc:orpc:*:*:*:*:*:*:*:*", "matchCriteriaId": "137D3616-F542-4117-A6F1-D7A0E9C57A01", "versionEndExcluding": "1.13.9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9."}, {"lang": "es", "value": "oRPC es una herramienta que ayuda a construir APIs que son de tipo seguro de extremo a extremo y se adhieren a los est\u00e1ndares de OpenAPI. Antes de la versi\u00f3n 1.13.9, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la generaci\u00f3n de documentaci\u00f3n de OpenAPI de oRPC. Si un atacante puede controlar cualquier campo dentro de la especificaci\u00f3n de OpenAPI (como info.description), pueden salir del contexto JSON y ejecutar JavaScript arbitrario cuando un usuario ve la documentaci\u00f3n de la API generada. Este problema ha sido parcheado en la versi\u00f3n 1.13.9."}], "id": "CVE-2026-33331", "lastModified": "2026-06-17T10:37:20.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33331", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T13:34:21.265192Z", "version": "2.0.3"}}]}, "published": "2026-03-24T20:16:28.547", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/middleapi/orpc/releases/tag/v1.13.9"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.13.9)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "orpc", "source": "cna", "vendor": "middleapi"}, "product": "orpc", "vendor": "middleapi"}], "analysis": {"en": {"generated_at": "2026-03-26T15:24:12.408999+00:00", "value": {"mitigation_remediation": ["Upgrade orpc to version 1.13.9 or newer."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting in API Documentation"}, "threat_synthesis": {"affected_systems": "The affected product is orpc from the middleapi organization. All releases before version 1.13.9 are vulnerable because the issue was patched in the 1.13.9 release.", "description_and_impact": "A stored cross\u2011site scripting vulnerability exists in the OpenAPI documentation generation of orpc. When an attacker can insert arbitrary content into any field within the OpenAPI specification \u2013 for example, the info.description field \u2013 the sanitization used by the tool fails to escape the JSON.stringify output, allowing the attacker to break out of the JSON context and execute JavaScript when a user opens the generated API documentation.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.2, indicating high severity. However, the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be able to modify the OpenAPI specification, which typically implies that the attacker has some level of access to the orpc configuration or file system. The attack vector is inferred to be a combination of privileged modification of the specification and a user viewing the documentation, so it is primarily a local or insider threat scenario."}}}}, "created": "2026-03-25T11:46:18.555126+00:00", "updated": "2026-03-27T09:20:38.283078+00:00", "vendors": ["middleapi", "middleapi$PRODUCT$orpc"]}