9 matches found
CVE-2026-103036
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
@c15t/backend (>=1.5.0-canary-20250902132553, <=1.8.6), @c15t/cli (>=1.5.0-canary-20250902132553, <=1.8.6) +14 more potentially affected by CVE-2026-103036 via @orpc/json-schema (>=1.7.0, <=1.14.8)
@orpc/json-schema NPM version =1.7.0, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.7.0, =1.5.0-canary-20250902132553, =1.8.6 -...
CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
CVE-2026-103036
The oRPC tool (specifically the @orpc/json-schema SmartCoercionPlugin ) is vulnerable to a prototype injection issue in versions prior to 1.14.9 . The root cause is the use of JsonSchemaCoercer to resolve schema.properties entries through the prototype chain. A remote client can supply __proto__ ...
EUVD-2026-91791
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
CVE-2026-103036: Improperly Controlled Modification of Dynamically-Determined Object Attributes
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...
PT-2026-104427
Name of the Vulnerable Software and Affected Versions oRPC versions prior to 1.14.9 Description The @orpc/json-schema SmartCoercionPlugin utilizes JsonSchemaCoercer to collect object properties in a plain object and resolve schema.properties entries via the prototype chain. A remote client...