Executive brief
oRPC is a tool used by developers to build type-safe APIs and generate technical documentation. A security flaw in the documentation generator allows an attacker to inject malicious code into the API description. If a user or administrator views the generated documentation, this code could execute in their browser, potentially leading to the theft of login sessions or unauthorized actions performed on their behalf.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation component of oRPC (specifically within the @orpc/openapi package). The root cause is the use of unescaped JSON.stringify() within the renderDocsHtml() function in openapi-reference.ts to embed the OpenAPI specification into an HTML template. Because JSON.stringify() does not escape HTML-sensitive characters like '<' and '>', an attacker who can control fields in the OpenAPI spec (such as info.description) can inject a closing </script> tag to break out of the JSON context and execute arbitrary JavaScript. This can be exploited remotely if the API specification is dynamically generated from user-controlled input. The issue is fixed in version 1.13.9 by properly escaping the serialized JSON.
Affected products
- middleapi oRPC < 1.13.9
Timeline
- 2026-03-20: patched: Version 1.13.9 released
- 2026-03-24: disclosed: CVE-2026-33331 published