CVE-2026-33331
HIGHoRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2026-33331. PoCs published by abhayclasher.
AI-analyzed exploit summary This repository contains a functional proof-of-concept for CVE-2026-33331, a stored XSS vulnerability in the oRPC OpenAPI Reference Plugin. The exploit demonstrates how an attacker can inject malicious JavaScript into an OpenAPI spec, which is then rendered unsafely in the generated documentation.
Description
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.
Exploits (1)
This repository contains a functional proof-of-concept for CVE-2026-33331, a stored XSS vulnerability in the oRPC OpenAPI Reference Plugin. The exploit demonstrates how an attacker can inject malicious JavaScript into an OpenAPI spec, which is then rendered unsafely in the generated documentation.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N