oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify
Date: 2026-03
Affected: npm/@orpc/openapi
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-33331
CWE: CWE-79
CVSS: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N)

A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. In the packages/openapi/src/plugins/openapi-reference.ts file, the renderDocsHtml() function takes an OpenAPI spec object and embeds it directly into the HTML response using a template literal: `<script id="spec" type="application/json">${JSON.stringify(spec)}</script>` The JSON.stringify() function does not escape HTML characters like < or >. Therefore, if an attacker provides a string containing </script><script>..., the browser will prematurely close the application/json script block and execute the subsequent malicious script block. Proof of Concept (PoC) 1. Create an API router with **orpc** and configure the OpenAPI plugin. 2. In the API specification, inject a malicious payload into a field like **description**: ``` { info: { title: "My API", version: "1.0.0", description: "</script><script>alert('XSS executed on ' + document.domain)</script>" } } ``` 3. Generate and serve the documentation HTML. 4. When a developer or user navigates to the API documentation URL, the browser parses the HTML, breaks out of the JSON block, and immediately executes the **alert()** payload. Impact If an application generates its OpenAPI specifications dynamical


Mitigations:

Architectural layers (MAESTRO):