CVE-2026-33331: middleapi orpc · Cross-site Scripting
Affects middleapi orpcSource CVE Database V5
Not known to be exploited · CVSS 8.2 High : upgrade to 1.13.9 soon.
Data as of 30 Oct 2026, 11:52 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 21% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.13.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 24 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: evidence found.
Public exploit code: GitHub proofs of concept
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), GitHub proofs of concept, the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.
What to do
Upgrade orpc and middleapi/orpc to 1.13.9.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| middleapiorpc | Affected
| Fixed in
|
GitHubmiddleapi/orpcpkg:github/middleapi/orpcOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
- Upgrade all instances of middleapi orpc to version 1.13.9 or later, where the vulnerability has been patched.
- Implement strict validation and sanitization of all fields in the OpenAPI specification, especially those that can be user-controlled or externally sourced, to prevent injection of malicious scripts.
- Restrict access to API documentation to trusted users only, using authentication and authorization controls, to reduce exposure to potential attackers.
- Employ Content Security Policy (CSP) headers on the documentation hosting environment to limit the execution of unauthorized scripts.
- Regularly audit and review OpenAPI specifications for suspicious or unexpected content before publishing documentation.
- Educate developers and API consumers about the risks of XSS in API documentation and encourage safe browsing practices.
- Monitor logs and user reports for signs of suspicious activity related to API documentation access.
- Consider isolating API documentation in sandboxed environments or separate domains to limit the impact of any potential XSS exploitation.
Description
CVE-2026-33331 is a high-severity stored cross-site scripting (XSS) vulnerability affecting versions of the middleapi orpc tool prior to 1.13.9. The vulnerability arises from improper neutralization of input during the generation of OpenAPI documentation, allowing attackers who can control fields in the OpenAPI specification (e.g. , info.description) to inject malicious JavaScript. When a user views the generated API documentation, this script executes, potentially compromising confidentiality by stealing sensitive data. Exploitation requires no authentication but does require user interaction to view the malicious documentation. The vulnerability has been patched in version 1.