{"action":"Upgrade @orpc/client to 1.13.6 or later.","affected":[{"fixed":"1.13.6","introduced":"0"}],"component":"@orpc/client","cve_ids":["CVE-2026-28794"],"ecosystem":"npm","epss":0.00944,"exploited":false,"fixed_versions":["1.13.6"],"ghsa_id":"GHSA-m272-9rp6-32mc","id":"tcs_01M5KFZ9WKRC7T2SJESW91N82A","modified_at":"2026-03-06T15:32:38.042375Z","published_at":"2026-03-02T21:43:00Z","references":["https://osv.dev/vulnerability/GHSA-m272-9rp6-32mc","https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc","https://nvd.nist.gov/vuln/detail/CVE-2026-28794","https://github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5","https://github.com/middleapi/orpc"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-m272-9rp6-32mc","url":"https://osv.dev/vulnerability/GHSA-m272-9rp6-32mc"},{"source":"nvd","source_id":"CVE-2026-28794","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28794"}],"summary":"`@orpc/client` has Prototype Pollution via `StandardRPCJsonSerializer` Deserialization"}