CVE-2026-33331

Analyzed Analyzed - Analysis Complete

Stored XSS in oRPC OpenAPI Docs Allows Arbitrary Script Execution

Publication date: 2026-03-24

Last updated on: 2026-06-01

Assigner: GitHub, Inc.

Description

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-24

Last Modified

2026-06-01

Generated

2026-07-06

AI Q&A

2026-03-24

EPSS Evaluated

2026-07-05

NVD

CVE-2026-33331

EUVD

EUVD-2026-14179

Affected Vendors & Products

Vendor	Product	Version / Range
orpc	orpc	to 1.13.9 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in the OpenAPI documentation generation feature of the oRPC tool prior to version 1.13.9.

If an attacker can control any field within the OpenAPI specification, such as the info.description field, they can inject malicious code that breaks out of the JSON context.

When a user views the generated API documentation, this malicious JavaScript can be executed, potentially compromising the user's security.

This vulnerability has been fixed in version 1.13.9 of oRPC.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary JavaScript code in the context of the API documentation viewed by users.

Such execution can lead to theft of sensitive information, session hijacking, or other malicious actions against users who access the affected documentation.

Because the vulnerability is exploitable remotely without privileges and requires only user interaction, it poses a significant security risk.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate this vulnerability, upgrade the orpc tool to version 1.13.9 or later, where the stored cross-site scripting (XSS) issue in the OpenAPI documentation generation has been patched.

Hi! I’m here to help you understand CVE-2026-33331. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70