oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. This issue has been patched in version 1.13.9.

Affected: npm: @orpc/openapi

A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. In the packages/openapi/src/plugins/openapi-reference.ts file, the renderDocsHtml() function takes an OpenAPI spec object and embeds it directly into the HTML response using a template literal:

`<script id="spec" type="application/json">${JSON.stringify(spec)}</script>`

The JSON.stringify() function does not escape HTML characters like < or >. Therefore, if an attacker provides a string containing </script><script>..., the browser will prematurely close the application/json script block and execute the subsequent malicious script block.

Proof of Concept (PoC)

1. Create an API router with **orpc** and configure the OpenAPI plugin. 2. In the API specification, inject a malicious payload into a field like **description**:

``` { info: { title: "My API", version: "1.0.0", description: "</script><script>alert('XSS executed on ' + document.domain)</script>" } } ```

3. Generate and serve the documentation HTML. 4. When a developer or user navigates to the API documentation URL, the browser parses the HTML, breaks out of the JSON block, and immediately executes the **alert()** payload.

Impact

If an application generates its OpenAPI specifications dynamica…