CVE-2026-33331 - Vulnerability Analysis

Overview

oRPC < 1.13.9 contains a stored XSS caused by improper sanitization of OpenAPI specification fields in documentation generation, letting attackers execute arbitrary JavaScript when users view API docs, exploit requires attacker control of OpenAPI spec fields.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in users' browsers, potentially leading to session hijacking or other client-side attacks.

Mitigation

Update to version 1.13.9 or later.

References

• https://github.com/middleapi/orpc/releases/tag/v1.13.9
• https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8
• https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 24, 2026

🟠 CVE-2026-33331 - High (8.2) oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33331/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner