CVE-2026-33331
1 advisory.
npm/@orpc/openapi CVE-2026-33331: high 8.2
oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Action: Upgrade @orpc/openapi to 1.13.9 or later.
npm i @orpc/openapi@1.13.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.13.9 | - |
Fixed versions
| 1.13.9 |
Sources
- osv: GHSA-7f6v-3gx7-27q8
- https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8
- https://nvd.nist.gov/vuln/detail/CVE-2026-33331
- https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add
- https://github.com/middleapi/orpc
- https://github.com/middleapi/orpc/releases/tag/v1.13.9
CVE-2026-33331 · published · modified · JSON