CVE-2026-33331: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33331 is a stored cross-site scripting (XSS) vulnerability in the OpenAPI documentation generation component of oRPC, a TypeScript library for building end-to-end type-safe APIs. The flaw affects all versions of the @orpc/openapi npm package prior to 1.13.9. It was disclosed on March 20, 2026, via a GitHub Security Advisory, and patched the same day in version 1.13.9. The vulnerability carries a CVSS v3.1 base score of 5.4 (Medium) per NVD, though the GitHub advisory rates it as High (8.2) under a different scoring assumption (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the use of raw JSON.stringify() to embed the OpenAPI specification object directly into an HTML <script> block within the renderDocsHtml() function in packages/openapi/src/plugins/openapi-reference.ts. Because JSON.stringify() does not escape HTML-sensitive characters such as < and >, an attacker who controls any string field in the OpenAPI spec (e.g., info.description) can inject a payload like </script><script>alert('XSS')</script> to break out of the JSON script block and execute arbitrary JavaScript. The fix in commit 4f0efa8 introduces an escapeJsonForHtml() helper that replaces <, >, &, ', and / with their Unicode escape equivalents before embedding JSON into HTML (GitHub Advisory, Patch Commit).

Successful exploitation allows an attacker with the ability to modify OpenAPI specification fields (e.g., a developer or any user-controlled input path that populates spec fields) to store malicious JavaScript that executes in the browsers of anyone who views the generated API documentation. This can lead to session hijacking, theft of authentication tokens or cookies, and unauthorized API calls performed on behalf of the victim — typically developers or administrators who review API docs. Confidentiality and integrity are both impacted at a low-to-moderate level; availability is not directly affected (GitHub Advisory).

A concrete proof-of-concept (PoC) with step-by-step reproduction instructions and a specific payload is publicly available in the GitHub Security Advisory, rated high confidence by Feedly threat intelligence. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.011% (0.000110), indicating a low probability of exploitation in the near term. Exploitation requires low privileges (ability to influence OpenAPI spec fields) and user interaction (a victim must view the documentation page) (GitHub Advisory).

1. Identify a target: Locate an application using @orpc/openapi version ≤1.13.8 that exposes a publicly or internally accessible API documentation endpoint (e.g., /docs or /reference).
2. Gain write access to OpenAPI spec fields: Obtain the ability to modify any string field in the OpenAPI specification — this could be through developer access, a misconfigured admin panel, or an application that dynamically populates spec fields from user-controlled input.
3. Inject the XSS payload: Set a spec field such as info.description to a value containing the breakout payload:

   </script><script>alert('XSS executed on ' + document.domain)</script>

4. Trigger documentation rendering: The malicious value is serialized via JSON.stringify() and embedded unsanitized into the HTML <script> block of the generated docs page.
5. Victim visits the docs page: When a developer or administrator navigates to the API documentation URL, the browser parses the HTML, prematurely closes the JSON script block, and executes the injected script — enabling session cookie theft, credential harvesting, or unauthorized API actions on behalf of the victim (GitHub Advisory).

• Network: Unexpected outbound requests from a user's browser to attacker-controlled domains originating from the API documentation page URL (e.g., GET https://attacker.com/?cookie=<session_token>).
• Logs: Web server access logs showing requests to the API docs endpoint (/docs, /reference, /spec.json) from unusual IP addresses or at unusual times; server-side logs showing modification of OpenAPI spec fields with HTML/script tag content.
• File System / Configuration: OpenAPI specification files or database entries containing </script>, <script>, or JavaScript event handlers (onerror, onload) within string fields such as info.description, info.title, or tag descriptions.
• Browser / Client-Side: Browser developer tools showing unexpected script execution or network requests when loading the API documentation page.

Upgrade the @orpc/openapi npm package to version 1.13.9 or later, which replaces raw JSON.stringify() with an escapeJsonForHtml() function that Unicode-escapes HTML-sensitive characters before embedding JSON into HTML templates (GitHub Release, Patch Commit). As a short-term workaround if upgrading is not immediately possible, restrict write access to OpenAPI specification fields to trusted administrators only, and implement server-side input validation to reject or sanitize HTML-sensitive characters in spec string fields. Additionally, consider deploying a Content Security Policy (CSP) header on the documentation endpoint to limit the impact of any injected scripts.

The vulnerability was discovered and reported by security researcher abhayclasher, who is credited in the GitHub Security Advisory and also published a related GitHub repository (GitHub Advisory). The oRPC maintainer (dinwwwh) responded promptly, merging the patch and releasing version 1.13.9 on the same day as disclosure (March 20, 2026). The issue received limited but notable coverage from automated vulnerability tracking platforms and a Bluesky post from a cybersecurity blog account, reflecting routine community awareness rather than widespread concern.