A stored cross-site scripting vulnerability in orpc versions prior to 1.13.9 poses a significant risk of unauthorized script execution within the generated API documentation.

The flaw is an improper neutralization of input during web page generation (CWE-79) residing in the OpenAPI documentation module, which allows an unauthenticated attacker to inject malicious payloads into fields like info.description that execute when a user views the documentation.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the browser of any user viewing the API documentation, potentially leading to session hijacking, credential theft, or unauthorized actions performed on the user's behalf. Given the CVSS score of 8.2, this represents a high-severity risk that could compromise the integrity of internal development environments and expose sensitive administrative or user sessions to external actors.

Immediate Action: Update the @orpc/openapi package to version 1.13.9 or later to incorporate the vendor-supplied security patch.

Proactive Monitoring: Monitor web access logs for unusual requests containing script tags or encoded payloads directed at API documentation endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to detect and block malicious payloads injected into input fields before they reach the documentation generator.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

The presence of a public proof-of-concept makes this vulnerability an attractive target for automated exploitation. Organizations utilizing orpc for API documentation generation must prioritize updating to version 1.13.9 immediately to eliminate the risk of XSS-based attacks against their development and engineering teams.