CVE-2026-33331 middleapi CVE debrief

Who should care

Organizations using oRPC to generate API documentation, particularly those exposing OpenAPI documentation interfaces to internal or external users. Development teams relying on oRPC's type-safe API builder with OpenAPI compliance. Security teams monitoring for XSS vulnerabilities in developer tooling and API infrastructure.

Technical summary

The oRPC framework's OpenAPI documentation generator fails to properly sanitize specification fields before rendering them in a web context. An attacker who can influence any field within the OpenAPI specification—demonstrated with info.description but potentially applicable to other fields—can craft input that breaks out of the intended JSON context and injects executable JavaScript. When a victim views the generated API documentation, the malicious script executes in their browser. This is classified as stored XSS because the payload persists in the generated documentation. The vulnerability requires user interaction (a victim viewing the documentation) and can lead to high confidentiality impact through session hijacking or credential theft, with low integrity impact from potential unauthorized actions performed via the victim's session. The fix in version 1.13.9 implements proper sanitization to prevent JSON context breakout and script injection.

Defensive priority

HIGH

Recommended defensive actions

• Upgrade oRPC to version 1.13.9 or later to remediate the stored XSS vulnerability in OpenAPI documentation generation.
• Review any custom OpenAPI specification fields (including info.description, titles, summaries, and other user-controllable content) for injected payloads if running affected versions prior to patching.
• Validate and sanitize all user-controllable input that feeds into OpenAPI specification generation, applying output encoding appropriate for JSON and HTML contexts.
• Monitor generated API documentation access logs for anomalous patterns that may indicate exploitation attempts.
• If immediate patching is not feasible, consider restricting access to generated OpenAPI documentation interfaces to trusted administrative users only.

Evidence notes

CVE published 2026-03-24; modified 2026-06-01. Vendor advisory and patch released via GitHub Security Advisories. CPE criteria confirms affected product as orpc:orpc with versions before 1.13.9. CWE-79 (Improper Neutralization of Input During Web Page Generation) identified as secondary weakness.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.