Vulnerability-Lookup

CVE-2026-33331 (GCVE-0-2026-33331)

Vulnerability from cvelistv5 – Published: 2026-03-24 19:18 – Updated: 2026-03-25 13:34

Title

oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

Summary

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.

Severity ?

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

GitHub_M

References

URL

Tags

	https://github.com/middleapi/orpc/security/adviso…	x_refsource_CONFIRM
	https://github.com/middleapi/orpc/commit/4f0efa8a…	x_refsource_MISC
	https://github.com/middleapi/orpc/releases/tag/v1.13.9	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	middleapi	orpc	Affected: < 1.13.9

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33331",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T13:34:21.265192Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T13:34:26.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "orpc",
          "vendor": "middleapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-24T19:18:00.164Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"
        },
        {
          "name": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"
        },
        {
          "name": "https://github.com/middleapi/orpc/releases/tag/v1.13.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/releases/tag/v1.13.9"
        }
      ],
      "source": {
        "advisory": "GHSA-7f6v-3gx7-27q8",
        "discovery": "UNKNOWN"
      },
      "title": "oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33331",
    "datePublished": "2026-03-24T19:18:00.164Z",
    "dateReserved": "2026-03-18T22:15:11.811Z",
    "dateUpdated": "2026-03-25T13:34:26.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33331",
      "date": "2026-05-10",
      "epss": "0.0002",
      "percentile": "0.05694"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33331\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-03-24T20:16:28.547\",\"lastModified\":\"2026-03-26T13:26:24.360\",\"vulnStatus\":\"Undergoing Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.\"},{\"lang\":\"es\",\"value\":\"oRPC es una herramienta que ayuda a construir APIs que son de tipo seguro de extremo a extremo y se adhieren a los est\u00e1ndares de OpenAPI. Antes de la versi\u00f3n 1.13.9, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la generaci\u00f3n de documentaci\u00f3n de OpenAPI de oRPC. Si un atacante puede controlar cualquier campo dentro de la especificaci\u00f3n de OpenAPI (como info.description), pueden salir del contexto JSON y ejecutar JavaScript arbitrario cuando un usuario ve la documentaci\u00f3n de la API generada. Este problema ha sido parcheado en la versi\u00f3n 1.13.9.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:orpc:orpc:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"1.13.9\",\"matchCriteriaId\":\"137D3616-F542-4117-A6F1-D7A0E9C57A01\"}]}]}],\"references\":[{\"url\":\"https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/middleapi/orpc/releases/tag/v1.13.9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\",\"Release Notes\"]},{\"url\":\"https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33331\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-25T13:34:21.265192Z\"}}}], \"references\": [{\"url\": \"https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-25T13:34:14.962Z\"}}], \"cna\": {\"title\": \"oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify\", \"source\": {\"advisory\": \"GHSA-7f6v-3gx7-27q8\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"middleapi\", \"product\": \"orpc\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.13.9\"}]}], \"references\": [{\"url\": \"https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8\", \"name\": \"https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add\", \"name\": \"https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/middleapi/orpc/releases/tag/v1.13.9\", \"name\": \"https://github.com/middleapi/orpc/releases/tag/v1.13.9\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-03-24T19:18:00.164Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33331\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-03-25T13:34:26.196Z\", \"dateReserved\": \"2026-03-18T22:15:11.811Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-03-24T19:18:00.164Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

GHSA-7F6V-3GX7-27Q8

Vulnerability from github – Published: 2026-03-20 17:25 – Updated: 2026-03-27 21:58

Summary

oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

Details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. In the packages/openapi/src/plugins/openapi-reference.ts file, the renderDocsHtml() function takes an OpenAPI spec object and embeds it directly into the HTML response using a template literal:

<script id="spec" type="application/json">${JSON.stringify(spec)}</script>

The JSON.stringify() function does not escape HTML characters like < or >. Therefore, if an attacker provides a string containing ..., the browser will prematurely close the application/json script block and execute the subsequent malicious script block.

Proof of Concept (PoC)

Create an API router with orpc and configure the OpenAPI plugin.
In the API specification, inject a malicious payload into a field like description:

{
info: {
title: "My API",
version: "1.0.0",
description: "</script><script>alert('XSS executed on ' + document.domain)</script>"
}
}

Generate and serve the documentation HTML.
When a developer or user navigates to the API documentation URL, the browser parses the HTML, breaks out of the JSON block, and immediately executes the alert() payload.

Impact

If an application generates its OpenAPI specifications dynamically based on user-controlled inputs (or if a rogue developer modifies the spec), it leads to Stored XSS. When an administrator or developer views the API docs, the script executes in their browser, potentially leading to session hijacking or unauthorized API calls on their behalf.

Remediation

Do not use raw JSON.stringify() to embed data directly into HTML templates. Instead, safely serialize the JSON by escaping HTML-sensitive characters (like < and >) or use a secure HTML serialization library (such as serialize-javascript or devalue) before embedding it into the tag.

Disclosure & Credits

If this report is helpful, I kindly request that you publish this as a formal GitHub Security Advisory and assign me credit for the discovery. Thank you for maintaining this project!

Severity ?

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.13.8"
      },
      "package": {
        "ecosystem": "npm",
        "name": "@orpc/openapi"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33331"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T17:25:56Z",
    "nvd_published_at": "2026-03-24T20:16:28Z",
    "severity": "HIGH"
  },
  "details": "A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation.\nIn the packages/openapi/src/plugins/openapi-reference.ts file, the renderDocsHtml() function takes an OpenAPI spec object and embeds it directly into the HTML response using a template literal:\n\n`\u003cscript id=\"spec\" type=\"application/json\"\u003e${JSON.stringify(spec)}\u003c/script\u003e`\n\nThe JSON.stringify() function does not escape HTML characters like \u003c or \u003e. Therefore, if an attacker provides a string containing \u003c/script\u003e\u003cscript\u003e..., the browser will prematurely close the application/json script block and execute the subsequent malicious script block.\n\nProof of Concept (PoC)\n\n1. Create an API router with **orpc** and configure the OpenAPI plugin.\n2. In the API specification, inject a malicious payload into a field like **description**:\n\n```\n{\ninfo: {\ntitle: \"My API\",\nversion: \"1.0.0\",\ndescription: \"\u003c/script\u003e\u003cscript\u003ealert(\u0027XSS executed on \u0027 + document.domain)\u003c/script\u003e\"\n}\n}\n```\n\n3. Generate and serve the documentation HTML.\n4. When a developer or user navigates to the API documentation URL, the browser parses the HTML, breaks out of the JSON block, and immediately executes the **alert()** payload.\n\nImpact\n\nIf an application generates its OpenAPI specifications dynamically based on user-controlled inputs (or if a rogue developer modifies the spec), it leads to Stored XSS. When an administrator or developer views the API docs, the script executes in their browser, potentially leading to session hijacking or unauthorized API calls on their behalf.\n\nRemediation\n\nDo not use raw **JSON.stringify()** to embed data directly into HTML templates. Instead, safely serialize the JSON by escaping HTML-sensitive characters (like **\u003c** and **\u003e**) or use a secure HTML serialization library (such as **serialize-javascript** or **devalue**) before embedding it into the **\u003cscript\u003e** tag.\n\nDisclosure \u0026 Credits\n\nIf this report is helpful, I kindly request that you publish this as a formal GitHub Security Advisory and assign me credit for the discovery. Thank you for maintaining this project!",
  "id": "GHSA-7f6v-3gx7-27q8",
  "modified": "2026-03-27T21:58:58Z",
  "published": "2026-03-20T17:25:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33331"
    },
    {
      "type": "WEB",
      "url": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/middleapi/orpc"
    },
    {
      "type": "WEB",
      "url": "https://github.com/middleapi/orpc/releases/tag/v1.13.9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify"
}

FKIE_CVE-2026-33331

Vulnerability from fkie_nvd - Published: 2026-03-24 20:16 - Updated: 2026-03-26 13:26

Severity ?

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add	Patch
security-advisories@github.com	https://github.com/middleapi/orpc/releases/tag/v1.13.9	Product, Release Notes
security-advisories@github.com	https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8	Exploit, Mitigation, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8	Exploit, Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	orpc	orpc	*

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:orpc:orpc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "137D3616-F542-4117-A6F1-D7A0E9C57A01",
              "versionEndExcluding": "1.13.9",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9."
    },
    {
      "lang": "es",
      "value": "oRPC es una herramienta que ayuda a construir APIs que son de tipo seguro de extremo a extremo y se adhieren a los est\u00e1ndares de OpenAPI. Antes de la versi\u00f3n 1.13.9, existe una vulnerabilidad de cross-site scripting (XSS) almacenado en la generaci\u00f3n de documentaci\u00f3n de OpenAPI de oRPC. Si un atacante puede controlar cualquier campo dentro de la especificaci\u00f3n de OpenAPI (como info.description), pueden salir del contexto JSON y ejecutar JavaScript arbitrario cuando un usuario ve la documentaci\u00f3n de la API generada. Este problema ha sido parcheado en la versi\u00f3n 1.13.9."
    }
  ],
  "id": "CVE-2026-33331",
  "lastModified": "2026-03-26T13:26:24.360",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2026-03-24T20:16:28.547",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/middleapi/orpc/releases/tag/v1.13.9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-33331 (GCVE-0-2026-33331)

GHSA-7F6V-3GX7-27Q8

FKIE_CVE-2026-33331

Tags

Sightings

Nomenclature