CVE-2026-33331 - Vulnerability Analysis

Overview

oRPC < 1.13.9 contains a stored XSS caused by improper sanitization of OpenAPI specification fields in documentation generation, letting attackers execute arbitrary JavaScript when users view API docs, exploit requires attacker control of OpenAPI spec fields.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in users' browsers, potentially leading to session hijacking or other client-side attacks.

Mitigation

Update to version 1.13.9 or later.

References

• https://github.com/middleapi/orpc/releases/tag/v1.13.9
• https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8
• https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner