The vulnerability arises in orpc's @orpc/json-schema SmartCoercionPlugin before version 1.14.9, where JsonSchemaCoercer collects object properties including those inherited through the prototype chain. A remote attacker can supply a __proto__ property or Object.prototype member names (e.g., constructor, toString) in an object input schema to replace the prototype of the coerced request object or cause inherited values to be treated as sub-schemas. This can lead to attacker-controlled inherited properties influencing handler logic, Object.assign operations, or configuration lookups. The global Object.prototype and unrelated objects remain unaffected, and downstream schema validation still executes. The vulnerability is addressed by the fix in version 1.14.9.

An unauthenticated remote attacker able to reach a procedure with an object input schema can manipulate the prototype of the coerced request object or introduce inherited properties that affect request handling or configuration lookups. This may lead to partial control over application logic or data processing within the affected request context. However, global objects and other users' requests are not impacted, and schema validation continues to run, limiting the scope of the impact.

Upgrade to orpc version 1.14.9 or later, where this vulnerability is fixed. No other mitigation is indicated or required as the fix addresses the root cause.