CVE-2026-103918

oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570
https://github.com/middleapi/orpc/pull/1727
https://github.com/middleapi/orpc/releases/tag/v1.14.10
https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2

Configurations

No configuration.

History

02 Oct 2026, 20:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-02 20:17

Updated : 2026-10-06 15:18

NVD link : CVE-2026-103918

Mitre link : CVE-2026-103918

CVE.ORG link : CVE-2026-103918

JSON object : View

Products Affected

No product.

CWE

CWE-915

Improperly Controlled Modification of Dynamically-Determined Object Attributes

CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

{"id": "CVE-2026-103918", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-103918", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-05T17:18:27.416064Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "middleapi", "product": "orpc", "versions": [{"status": "affected", "version": "< 1.14.10"}]}]}], "published": "2026-10-02T20:17:00.067", "references": [{"url": "https://github.com/middleapi/orpc/commit/26314dfb443237c495116c5794d3d30a7a22c570", "source": "security-advisories@github.com"}, {"url": "https://github.com/middleapi/orpc/pull/1727", "source": "security-advisories@github.com"}, {"url": "https://github.com/middleapi/orpc/releases/tag/v1.14.10", "source": "security-advisories@github.com"}, {"url": "https://github.com/middleapi/orpc/security/advisories/GHSA-gcgf-fh7c-8gf2", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-915"}, {"lang": "en", "value": "CWE-1321"}]}], "descriptions": [{"lang": "en", "value": "oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolve shape keys through the prototype chain. A remote client that can reach a procedure with an object or record input can supply __proto__ to replace the prototype of the returned request object, allowing attacker-controlled inherited values to reach application lookups. For object schemas, keys such as constructor, toString, and __proto__ can instead resolve inherited members as Zod schemas and cause an unhandled TypeError before validation. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and the availability effect is limited to crafted requests rather than persistent process-wide state. This issue is fixed in version 1.14.10."}], "lastModified": "2026-10-06T15:18:12.170", "sourceIdentifier": "security-advisories@github.com"}