oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

Successful exploitation of this XSS vulnerability allows an attacker to execute arbitrary JavaScript code within the context of a user's browser when they view the generated API documentation. This can lead to various malicious outcomes, including session hijacking, credential theft, and defacement of the API documentation. The attacker's ability to control the JavaScript payload provides significant flexibility in the attack, enabling them to target specific user actions or data. The impact is amplified if the API documentation is publicly accessible or widely distributed.

Development teams using @orpc/openapi to generate API documentation are at risk. This includes organizations that rely on automated documentation generation tools and those with publicly accessible API documentation. Projects using older versions of @orpc/openapi, particularly those with limited security testing or input validation, are especially vulnerable.

• nodejs: Inspect the package.json file for @orpc/openapi versions prior to 1.13.9. Use npm list @orpc/openapi to confirm the installed version. • generic web: Monitor API documentation endpoints for unusual JavaScript execution. Examine access logs for requests containing suspicious characters or payloads in the info.description parameter. • generic web: Use curl to test the API documentation endpoint with a simple XSS payload in the info.description parameter: curl 'YOURAPIENDPOINT?info.description=<script>alert(1)</script>' and check the response for the alert.

1. 2026-03-20Disclosure

   disclosure

1. Reservado2026-03-18
2. Publicada2026-03-20
3. Modificada2026-03-27
4. EPSS atualizado2026-04-01

The primary mitigation for CVE-2026-33331 is to upgrade to version 1.13.9 or later of the @orpc/openapi library. If upgrading is not immediately feasible, consider implementing input validation and sanitization on any user-controlled data used within the OpenAPI specification. Specifically, carefully scrutinize the info.description field and other potentially vulnerable fields. While not a direct fix, a Web Application Firewall (WAF) configured to detect and block XSS payloads targeting the API documentation endpoint could provide an additional layer of defense. After upgrading, verify the fix by attempting to inject a simple JavaScript payload into the info.description field and confirming that it is not executed when viewing the generated documentation.