oRPC CVE-2026-103918

The target application must use the @orpc/zod ZodSmartCoercionPlugin or experimental_ZodSmartCoercionPlugin at a version prior to 1.14.10, and must expose at least one procedure whose Zod input schema is an object or record type (z.object / z.record). A remote client only needs to be able to reach such a procedure and submit a crafted input (e.g. a __proto__ key, or object keys like constructor/toString); no authentication (PR:N) and no user interaction (UI:N) are required. Limiting factors that reduce real-world impact: the effect is confined to the attacker's own crafted request object - it does not modify the global Object.prototype, other requests, other users, or persistent process state - so there is no cross-tenant or persistent availability impact, and the attacker must know of a procedure that accepts object/record input and relies on the smart-coercion plugin.

This is a genuine but moderate-priority vulnerability (CWE-915, prototype injection) in the @orpc/zod ZodSmartCoercionPlugin. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) is internally consistent with the description: a remote, unauthenticated client reaching any procedure that accepts object or record input can send a __proto__ payload during input coercion. The exploitation status is 'no public exploit identified at time of analysis' - no KEV listing, no POC flag, and no EPSS probability were supplied, so there is no evidence of active or at-scale exploitation. The SSVC/impact signals argue against treating this as critical: the advisory and description explicitly scope the damage - the global Object.prototype, unrelated objects, other requests, and other users are NOT modified, and the availability impact is limited to the single crafted request (an unhandled TypeError before validation), not persistent process-wide denial of service, which is why A:N is appropriate. The realistic risk is therefore request-scoped: attacker-controlled inherited values reaching that one request's application lookups (the C:L / I:L basis). Net: a real issue worth patching promptly for anyone running the affected plugin, but not a drop-everything emergency absent active-exploitation signals. No EPSS/KEV/POC data was provided, so exploitation likelihood cannot be quantified from the input.

An attacker with network reach to an oRPC API procedure that validates object or record input via the ZodSmartCoercionPlugin sends a JSON body containing a __proto__ key (e.g. {"a":"123","__proto__":{"polluted":"true"}}). During smart coercion the library builds a plain object and resolves shape keys through the prototype chain, so the crafted prototype or inherited members (constructor, toString) feed back into the request object's lookups or trigger an unhandled TypeError before validation. No public exploit code is identified, but the fix PR (#1727) includes a working reproduction test demonstrating the payload.