High, CVSS 8.2npmAmendedPublished
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
CVE-2026-33331 · GHSA-7f6v-3gx7-27q8
- Affected
- npm @orpc/openapi <= 1.13.8
- Fixed in
- 1.13.9· Vendor fix available
- Issue
- A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. In the packages/openapi/src/plugins/openapi-reference.ts file, the renderDocsHtml() function takes an OpenAPI spec object and embeds it directly into the HTML response using a template literal: <script id="spec" type="application/json"${JSON.stringify(spec)}</script The JSON.stringify() function does not escape HTML characters like < or . Therefore, if an attacker provides a string containing </script<script..., the browser will prematurely close the application/json script block and execute the subsequent malicious script block. Proof of Concept (PoC) 1. Create an API router with orpc and configure the OpenAPI plugin. 2. In the API specification, inject a…
Recommended action: Upgrade to 1.13.9 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.