CVE-2026-33331

CVE-2026-33331 — Stored XSS in oRPC OpenAPI Reference Plugin Proof-of-concept lab for stored XSS in orpc's OpenAPI documentation generation Purpose oRPC builds API docs pages from an OpenAPI spec. Before v1.13.9 it dumped the spec directly into a tag using JSON.stringify with no HTML encoding. An...

EUVD-2026-91793

@orpc/zod: Prototype injection in smart coercion...

@orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: OSV:GHSA-GCGF-FH7C-8GF2...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: SNYK:JS-ORPCZOD-21691385...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: GHSA-GCGF-FH7C-8GF2...

GHSA-GCGF-FH7C-8GF2 @orpc/zod: Prototype injection in smart coercion

Summary ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin mishandle object keys that name Object.prototype members. Both coerce request input before validation, so any client that can reach a procedure whose input schema contains an object or a record can: 1. replace the prototype of...

@c15t/backend (>=1.5.0-canary-20250902132553, <=1.8.6), @c15t/cli (>=1.5.0-canary-20250902132553, <=1.8.6) +14 more potentially affected by CVE-2026-103036 via @orpc/json-schema (>=1.7.0, <=1.14.8)

@orpc/json-schema NPM version =1.7.0, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =1.5.0-canary-20250902132553, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.7.0, =1.5.0-canary-20250902132553, =1.8.6 -...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via JsonSchemaCoercercoerce in coercer.ts, where attacker-controlled keys from untrusted input are processed before validation by the SmartCoercionPlugin. Wh...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103036

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103918

The oRPC tool is vulnerable to prototype pollution in versions prior to 1.14.10 due to how the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin handle object and record properties. The root cause lies in resolving shape keys through the prototype chain , which allows a rem...

CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

@c15t/backend (>=1.1.0-canary.0, <=1.8.6), @c15t/cli (>=1.1.0-canary.0, <=1.8.6) +13 more potentially affected by CVE-2026-103918 via @orpc/zod (>=1.2.0, <=1.14.8)

@orpc/zod NPM version =1.2.0, =1.1.0-canary.0, =1.1.0-canary.0, =1.2.0-canary.0, =1.2.2-canary-20250514183211, =1.2.0-canary.8, =1.2.0-canary.0, =0.1.1, =0.1.0, =0.4.0, =0.4.0, =1.2.0-canary.0, =0.0.3, =0.0.12 Source cves: CVE-2026-103918 Source advisory: MEND:CVE-2026-103918...

CVE-2026-103918 @orpc/zod: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimentalZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chai...

CVE-2026-103036

The oRPC tool (specifically the @orpc/json-schema SmartCoercionPlugin ) is vulnerable to a prototype injection issue in versions prior to 1.14.9 . The root cause is the use of JsonSchemaCoercer to resolve schema.properties entries through the prototype chain. A remote client can supply __proto__ ...

CVE-2026-103036

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...

CVE-2026-103036 @orpc/json-schema: Prototype injection in smart coercion

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain...