Threats affecting pkg:github/middleapi/orpc

CVE-2026-103036 is a medium severity vulnerability in the orpc component of middleapi prior to version 1.14.9. It involves improper control of dynamically-determined object attributes during JSON schema coercion, allowing a remote client to supply crafted __proto__ or Object.prototype properties that influence the behavior of the coerced request object. This can affect handler logic and configuration lookups without modifying global objects or other users' requests. The issue is fixed in version 1.14.9.

CVE-2026-33331 is a high-severity stored cross-site scripting (XSS) vulnerability affecting versions of the middleapi orpc tool prior to 1.13.9. The vulnerability arises from improper neutralization of input during the generation of OpenAPI documentation, allowing attackers who can control fields in the OpenAPI specification (e.g. , info.description) to inject malicious JavaScript. When a user views the generated API documentation, this script executes, potentially compromising confidentiality by stealing sensitive data. Exploitation requires no authentication but does require user interaction to view the malicious documentation. The vulnerability has been patched in version 1.