Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-28794— oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization

Quick assessment

Affected
middleapi orpc
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

orpc是middleapi开源的一个RPC与OpenAPI集成框架。 oRPC 1.13.6之前版本存在安全漏洞，该漏洞源于@orpc/client包的RPC JSON反序列化器中存在原型污染，可能导致未经身份验证的远程攻击者向全局Object.prototype注入任意属性，从而引发身份验证绕过、拒绝服务或远程代码执行。

AI Predicted 9.8 Difficulty: Easy EPSS 1.12% · P65

Possible ATT&CK Techniques 1 AI

T1556 · Modify Authentication Process
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-28794

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
oRPC: Prototype Pollution in `@orpc/client` via `StandardRPCJsonSerializer` Deserialization
Source: CVE Program / CVE List V5
Vulnerability Description
oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5
Vulnerability Title
orpc 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
orpc是middleapi开源的一个RPC与OpenAPI集成框架。 oRPC 1.13.6之前版本存在安全漏洞，该漏洞源于@orpc/client包的RPC JSON反序列化器中存在原型污染，可能导致未经身份验证的远程攻击者向全局Object.prototype注入任意属性，从而引发身份验证绕过、拒绝服务或远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
middleapi orpc < 1.13.6 -

II. Public POCs for CVE-2026-28794

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-28794

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-28794 (1)

Vendor Advisories for CVE-2026-28794 (1)

IV. Related Vulnerabilities

Same product: orpc
Same vendor: middleapi
Same weakness: CWE-1321

V. Comments for CVE-2026-28794

No comments yet

Leave a comment