VulnSocial

CVE-2026-33331Disclosure(orpc / orpc)

LOWCVSS 5.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch orpc orpc systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.

orpc CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Patch / fix
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • orpc

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
orpc
Products
orpc

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-03-24: 1Patch / Workaround · 2026-03-24: 1Technical Details · 2026-03-24: 103-24
Signal classification1 categories
Disclosure
1100.0%
Referenced assets1 URL
By indicator
Full discourse1 post
  • The Hacker Wire@TheHackerWire
    Disclosure

    🟠 CVE-2026-33331 - High oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the O... https://www.thehackerwire.com/vulnerability/CVE-2026-33331/ https://t.co/E9LSLnKwcU

    Post summary

    The text announces CVE‑2026‑33331, a high‑severity stored XSS flaw in oRPC that is fixed in version 1.13.9, without offering PoC, exploit code, or evidence of active exploitation.

    0000045
    145 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Apporpcorpc---

Explore more

Back to dashboardorpc CVEsorpc vulnerabilities