Stored Cross-Site Scripting Vulnerability in oRPC API Tool by MiddleAPI
CVE-2026-33331
8.2HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-33331?
The oRPC tool, which is designed for building APIs that maintain type safety and comply with OpenAPI standards, contains a stored XSS vulnerability prior to version 1.13.9. If an attacker gains control over specific fields in the OpenAPI specification, such as 'info.description', they can exploit this vulnerability to execute arbitrary JavaScript when the API documentation is viewed by users. This poses a significant security risk that has been addressed in the latest version.
Affected Version(s)
orpc < 1.13.9
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.