A stored cross‑site scripting vulnerability exists in the OpenAPI documentation generation of orpc. When an attacker can insert arbitrary content into any field within the OpenAPI specification – for example, the info.description field – the sanitization used by the tool fails to escape the JSON.stringify output, allowing the attacker to break out of the JSON context and execute JavaScript when a user opens the generated API documentation.

The affected product is orpc from the middleapi organization. All releases before version 1.13.9 are vulnerable because the issue was patched in the 1.13.9 release.

The vulnerability carries a CVSS score of 8.2, indicating high severity. However, the EPSS score is below 1%, suggesting a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to be able to modify the OpenAPI specification, which typically implies that the attacker has some level of access to the orpc configuration or file system. The attack vector is inferred to be a combination of privileged modification of the specification and a user viewing the documentation, so it is primarily a local or insider threat scenario.