oRPC has Stored XSS in OpenAPI Reference Plugin via unescaped JSON.stringify

A Stored Cross-Site Scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScript when a user views the generated API documentation. In the packages/openapi/src/plugins/openapi-reference.ts file, the renderDocsHtml() function takes an OpenAPI spec object and embeds it directly into the HTML response using a template literal:

<script id="spec" type="application/json">${JSON.stringify(spec)}</script>

The JSON.stringify() function does not escape HTML characters like < or >. Therefore, if an attacker provides a string containing </script><script>..., the browser will prematurely close the application/json script block and execute the subsequent malicious script block.

Proof of Concept (PoC)

1. Create an API router with orpc and configure the OpenAPI plugin.
2. In the API specification, inject a malicious payload into a field like description:

{
info: {
title: "My API",
version: "1.0.0",
description: "</script><script>alert('XSS executed on ' + document.domain)</script>"
}
}

3. Generate and serve the documentation HTML.
4. When a developer or user navigates to the API documentation URL, the browser parses the HTML, breaks out of the JSON block, and immediately executes the alert() payload.

Impact

If an application generates its OpenAPI specifications dynamically based on user-controlled inputs (or if a rogue developer modifies the spec), it leads to Stored XSS. When an administrator or developer views the API docs, the script executes in their browser, potentially leading to session hijacking or unauthorized API calls on their behalf.

Remediation

Do not use raw JSON.stringify() to embed data directly into HTML templates. Instead, safely serialize the JSON by escaping HTML-sensitive characters (like < and >) or use a secure HTML serialization library (such as serialize-javascript or devalue) before embedding it into the <script> tag.

Disclosure & Credits

If this report is helpful, I kindly request that you publish this as a formal GitHub Security Advisory and assign me credit for the discovery. Thank you for maintaining this project!