{"id":"CVE-2026-103036","revision":"c1b9a0b38a364d0bbe0de2f7fd8d83b2","records":[{"revision":"c1b9a0b38a364d0bbe0de2f7fd8d83b2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-103036","aliases":[],"title":"@orpc/json-schema: Prototype injection in smart coercion","description":"oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properties entries through the prototype chain. A remote client that can reach a procedure with an object input schema can supply __proto__ to replace the prototype of the single coerced request object, or supply Object.prototype member names such as constructor and toString so inherited values are treated as sub-schemas and pass the coercer's satisfaction check. Attacker-controlled inherited properties can consequently affect handler, Object.assign, or configuration lookups, while legitimate __proto__ properties are dropped. The global Object.prototype, unrelated objects, other requests, and other users are not modified, and downstream schema validation still runs. This issue is fixed in version 1.14.9.","state":0,"publishedAt":"2026-10-02T19:59:23.947+00:00","modifiedAt":"2026-10-05T20:01:40.65+00:00","affected":[{"ecosystem":"Vendor product","name":"orpc","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"middleapi\",\n                    \"product\": \"orpc\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.14.9\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/middleapi/orpc/security/advisories/GHSA-4h5r-cv8j-4456","https://github.com/middleapi/orpc/pull/1726","https://github.com/middleapi/orpc/commit/8a352622e756e8956311f5836cd5c5b9219c0666","https://github.com/middleapi/orpc/releases/tag/v1.14.9"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-103036","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-103036","identifiers":["CVE-2026-103036"]},"retained":false,"historicalAffected":[]}],"coverage":[]}