CVE-2026-33331: Stored XSS Vulnerability in @orpc/openapi via Unescaped JSON.stringify
Summary
CVE-2026-33331: oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify. Affects @orpc/openapi versions < 1.13.9. Fixed in 1.13.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @orpc/openapi package is a tool designed for generating OpenAPI documentation for APIs built with the orpc framework. It allows developers to create interactive and user-friendly API documentation that can be easily shared and accessed. However, this package is vulnerable to a Stored Cross-Site Scripting (XSS) attack due to improper handling of user-controlled input in the OpenAPI specification.
Vulnerability Detail
A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. The vulnerability arises from the use of JSON.stringify() to embed the OpenAPI spec directly into HTML without escaping HTML-sensitive characters. This can lead to malicious scripts being executed in the browser, potentially resulting in session hijacking or unauthorized API calls.
How To Fix
Latest published version: 1.16.1 as of 23 Oct 2026
npm install @orpc/openapi@1.16.1Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.13.9
This is the first release that contains the fix.
npm install @orpc/openapi@1.13.9Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using raw JSON.stringify() to embed data directly into HTML templates. Instead, use a secure HTML serialization library, such as serialize-javascript or devalue, to safely serialize the JSON before embedding it into the <script> tag. For example:
const safeJSON = serialize(spec);
<script id="spec" type="application/json">${safeJSON}</script>
Conclusion
The @orpc/openapi package has a critical Stored XSS vulnerability that can be exploited if user-controlled input is not properly sanitized. It is essential to update to the patched version and implement secure coding practices to protect against such vulnerabilities.
See every vulnerability recorded for @orpc/openapi →
FAQ
Stored XSS is a type of security vulnerability where an attacker is able to inject malicious scripts into content that is stored on the server and later served to users. This can lead to unauthorized actions being performed on behalf of the user.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can also use the Vulert playground to test your application without any signup.
The potential impacts include session hijacking, unauthorized API calls, and exposure of sensitive user data, as the malicious script can execute in the context of the user's session.
Yes, a patch is available. Update the @orpc/openapi package to version 1.13.9 or later to mitigate this vulnerability.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
