What is the CVSS score of CVE-2026-28794?

CVE-2026-28794 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.8%.

Is there a public PoC exploit available for CVE-2026-28794?

Yes, a public proof-of-concept exploit is available for CVE-2026-28794. Prioritise patching immediately. EPSS: 0.8%.

How to fix or mitigate CVE-2026-28794?

Within 24 hours: Identify all systems and dependencies using @orpc/client versions prior to 1.13.6 and isolate affected applications from production if not yet patched. Within 7 days: Apply vendor patch to version 1.13.6 or later across all affected systems and validate through testing. Within 30 days: Conduct security audit of systems that were running vulnerable versions to detect any unauthorized access or object pollution artifacts.

Orpc CVE-2026-28794

CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-03-06 security-advisories@github.com

GHSA-m272-9rp6-32mc

Authentication Bypass RCE Denial Of Service Deserialization Node.js Orpc

9.8

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send malicious RPC JSON payload
Exploit

Deserializer injects properties into Object.prototype
Execution

Polluted prototype affects all application objects
Impact

Bypass authentication or execute arbitrary code

Vulnerability Assessment

Weakness	CWE CWE-1321 OWASP Top 10:2025 A03:2021 - Injection ASVS 5.0 V3 - Web Frontend Security Prototype pollution prevention MITRE ATT&CK 2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions — remote unauthenticated exploitation against @orpc/client package versions prior to 1.13.6 receiving RPC JSON payloads from untrusted sources.
Impact	CVSS 9.8, EPSS 0.77%.
Exploit ScenarioDerived	Prototype pollution for RCE.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

Patch available 0.8% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Prototype pollution in oRPC before 1.13.6. PoC and patch available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:06 CVSS 9.8

Prototype pollution in oRPC.

RemediationAI

Update.

Affected Packages

npm @orpc/client fix: 1.13.6

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-1321.

Know when Orpc gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Mar 10, 2026 - 19:48 vuln.today

Public exploit code

Patch released

Mar 10, 2026 - 19:48 nvd

Patch available

CVE Published

Mar 06, 2026 - 05:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.6, a prototype pollution vulnerability exists in the RPC JSON deserializer of the @orpc/client package. The vulnerability allows unauthenticated, remote attackers to inject arbitrary properties into the global Object.prototype. Because this pollution persists for the lifetime of the Node.js process and affects all objects, it can lead to severe security breaches, including authentication bypass, denial of service, and potentially Remote Code Execution. This issue has been patched in version 1.13.6.

Executive ViewAI

Why It Matters

A critical vulnerability in the oRPC @orpc/client package (CVE-2026-28794) allows remote attackers to inject malicious code into application memory without authentication. Any organization using affected versions risks unauthorized data access, application manipulation, and potential complete system compromise, with active exploits already circulating in the wild.

Business Impact: Severe

Compensating Controls

Apply vendor patch. If immediate patching is not possible: implement strict input validation on all RPC JSON deserializer endpoints, restrict network access to affected services to trusted sources only, monitor Node.js process memory for unexpected prototype modifications, and consider disabling oRPC API endpoints until patches are applied.

Threat Intelligence Overview

EPSS Score

0.8%

Top 27% exploitable

Exploit

POC

Public exploit code exists

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.8%

Patch available Yes

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +49

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Insecure Deserialization CRITICAL

Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.

Remote Code Execution CRITICAL

Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.