CVE-2026-33331
Analyzed Analyzed - Analysis Complete
Stored XSS in oRPC OpenAPI Docs Allows Arbitrary Script Execution

Publication date: 2026-03-24

Last updated on: 2026-06-01

Assigner: GitHub, Inc.

Description
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-24
Last Modified
2026-06-01
Generated
2026-06-16
AI Q&A
2026-03-24
EPSS Evaluated
2026-06-15
NVD
CVE-2026-33331
EUVD
EUVD-2026-14179
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
orpc orpc to 1.13.9 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the OpenAPI documentation generation feature of the oRPC tool prior to version 1.13.9.

If an attacker can control any field within the OpenAPI specification, such as the info.description field, they can inject malicious code that breaks out of the JSON context.

When a user views the generated API documentation, this malicious JavaScript can be executed, potentially compromising the user's security.

This vulnerability has been fixed in version 1.13.9 of oRPC.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary JavaScript code in the context of the API documentation viewed by users.

Such execution can lead to theft of sensitive information, session hijacking, or other malicious actions against users who access the affected documentation.

Because the vulnerability is exploitable remotely without privileges and requires only user interaction, it poses a significant security risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade the orpc tool to version 1.13.9 or later, where the stored cross-site scripting (XSS) issue in the OpenAPI documentation generation has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33331. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart