Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "orpc",
          "vendor": "middleapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.14.10"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T20:02:50.946Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2"
        },
        {
          "name": "https://github.com/middleapi/orpc/pull/1727",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/pull/1727"
        },
        {
          "name": "https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570"
        },
        {
          "name": "https://github.com/middleapi/orpc/releases/tag/v1.14.10",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/releases/tag/v1.14.10"
        }
      ],
      "source": {
        "advisory": "GHSA-gcgf-fh7c-8gf2",
        "discovery": "UNKNOWN"
      },
      "title": "@orpc/zod: Prototype injection in smart coercion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-103918",
    "datePublished": "2026-10-02T20:02:50.946Z",
    "dateReserved": "2026-10-01T14:20:19.153Z",
    "dateUpdated": "2026-10-02T20:02:50.946Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "orpc",
          "vendor": "middleapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.14.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client that can reach a procedure with an object input schema can supply __proto__ to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas and pass the coercer\u0027s satisfaction check. Attacker-controlled inherited properties can consequently affect handler, Object.assign, or configuration lookups, while legitimate __proto__ properties are dropped. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and downstream schema validation still runs. This issue is fixed in version 1.14.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T20:00:46.620Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/middleapi/orpc/security/advisories/GHSA-4h5r-cv8j-4456",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-4h5r-cv8j-4456"
        },
        {
          "name": "https://github.com/middleapi/orpc/pull/1726",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/pull/1726"
        },
        {
          "name": "https://github.com/middleapi/orpc/commit/8a352622e756e8956311f5836cd5c5b9219c0666",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/commit/8a352622e756e8956311f5836cd5c5b9219c0666"
        },
        {
          "name": "https://github.com/middleapi/orpc/releases/tag/v1.14.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/releases/tag/v1.14.9"
        }
      ],
      "source": {
        "advisory": "GHSA-4h5r-cv8j-4456",
        "discovery": "UNKNOWN"
      },
      "title": "@orpc/json-schema: Prototype injection in smart coercion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-103036",
    "datePublished": "2026-10-02T19:59:23.947Z",
    "dateReserved": "2026-09-29T21:13:24.032Z",
    "dateUpdated": "2026-10-02T20:00:46.620Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77360",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T19:40:46.280651Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T19:40:51.991Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/middleapi/orpc/issues/1661"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "orpc",
          "vendor": "middleapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.14.8"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.8, the @orpc/server CORS plugin in packages/server/src/plugins/cors.ts copies a client\u0027s incoming Vary request header into the response instead of controlling Vary as a response-only header and using Origin for request-origin variation. In deployments behind a shared cache, CDN, or reverse proxy that keys responses using Vary, a client can inject arbitrary variation values, pollute cache keys, and cause inconsistent CORS enforcement for other clients. Default non-cached configurations have no established direct confidentiality, integrity, or availability impact. This issue is fixed in version 1.14.8."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-113",
              "description": "CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T18:42:45.816Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/middleapi/orpc/security/advisories/GHSA-j9v4-rhgr-4m5f",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-j9v4-rhgr-4m5f"
        },
        {
          "name": "https://github.com/middleapi/orpc/issues/1661",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/issues/1661"
        },
        {
          "name": "https://github.com/middleapi/orpc/pull/1662",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/pull/1662"
        },
        {
          "name": "https://github.com/middleapi/orpc/commit/daabded122a89d323357c4c401e879701864cb2f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/commit/daabded122a89d323357c4c401e879701864cb2f"
        },
        {
          "name": "https://github.com/middleapi/orpc/releases/tag/v1.14.8",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/releases/tag/v1.14.8"
        }
      ],
      "source": {
        "advisory": "GHSA-j9v4-rhgr-4m5f",
        "discovery": "UNKNOWN"
      },
      "title": "oRPC: Vary Header Injection in CORS Plugin leading to potential Cache/CORS Bypass"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77360",
    "datePublished": "2026-09-16T18:42:45.816Z",
    "dateReserved": "2026-08-20T19:28:35.245Z",
    "dateUpdated": "2026-09-16T19:40:51.991Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33331",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-25T13:34:21.265192Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-25T13:34:26.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "orpc",
          "vendor": "middleapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-24T19:18:00.164Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-7f6v-3gx7-27q8"
        },
        {
          "name": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/commit/4f0efa8a1d3fa8e8317a4b03cc3945a5dfd68add"
        },
        {
          "name": "https://github.com/middleapi/orpc/releases/tag/v1.13.9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/releases/tag/v1.13.9"
        }
      ],
      "source": {
        "advisory": "GHSA-7f6v-3gx7-27q8",
        "discovery": "UNKNOWN"
      },
      "title": "oRPC: Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33331",
    "datePublished": "2026-03-24T19:18:00.164Z",
    "dateReserved": "2026-03-18T22:15:11.811Z",
    "dateUpdated": "2026-03-25T13:34:26.196Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-28794",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-03-09T19:53:21.791713Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-03-09T19:53:35.764Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "orpc",
          "vendor": "middleapi",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1321",
              "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-06T05:02:19.019Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/middleapi/orpc/security/advisories/GHSA-m272-9rp6-32mc"
        },
        {
          "name": "https://github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/middleapi/orpc/commit/1dba06fc6f938c2486de303c2fa096bc1c8418b5"
        }
      ],
      "source": {
        "advisory": "GHSA-m272-9rp6-32mc",
        "discovery": "UNKNOWN"
      },
      "title": "oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-28794",
    "datePublished": "2026-03-06T05:02:19.019Z",
    "dateReserved": "2026-03-03T14:25:19.245Z",
    "dateUpdated": "2026-03-09T19:53:35.764Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}