oRPC json-schema EUVD-2026-91791

Exploitation requires the target application to use the @orpc/json-schema SmartCoercionPlugin (JsonSchemaCoercer) and to expose at least one procedure with an OBJECT input schema reachable by the remote client; the attacker then supplies '__proto__' or Object.prototype member names (e.g. 'constructor', 'toString') in the request body. Limiting factors that reduce real-world risk: the manipulation is scoped to the single coerced request object only - global Object.prototype, other objects, concurrent requests, and other users are unaffected; legitimate '__proto__' own-properties are dropped; and downstream schema validation still runs after coercion, constraining how far poisoned values propagate into handler, Object.assign, or configuration logic. Deployments not using SmartCoercionPlugin, or using only non-object input schemas, are not exposed.

This is a moderate, not high-priority, issue despite a reasonable CVSS 6.5. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N confirms a remote, unauthenticated, low-complexity reach against any procedure exposing an object input schema, which is why the base score is non-trivial. However, the real-world severity is materially bounded by the vulnerability's own description: this is a SCOPED prototype manipulation, not classic global prototype pollution - the global Object.prototype, unrelated objects, concurrent requests, and other users are explicitly NOT affected, and downstream schema validation still executes. The impact is therefore limited to attacker-controlled inherited properties influencing the single coerced request object's handler, Object.assign, or configuration lookups (C:L/I:L, A:N), consistent with an SSVC 'partial' technical impact rather than total. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence set, so there is no signal of active or probable near-term exploitation - this reads as a defensively-disclosed GitHub advisory (reporter GitHub_M, GHSA-4h5r-cv8j-4456) with a vendor patch already shipped. There is no conflict between signals; the main caveat is that EPSS/KEV/POC data is simply absent rather than contradictory, so exploitation likelihood cannot be quantified and should be treated as low-to-unknown.

An attacker reaches an oRPC procedure whose input is an object schema and is coerced by the @orpc/json-schema SmartCoercionPlugin. They submit a JSON payload containing '__proto__' or Object.prototype member names such as 'constructor' or 'toString', causing inherited values to be treated as sub-schemas and influencing the handler's subsequent property, Object.assign, or configuration lookups for that request. No public exploit code was identified at time of analysis, and the manipulation is confined to that single request object rather than the global prototype.