Openapi — PoC Archivehttps://poc.intelseclab.com/tags/openapi/Latest proof-of-concept entries.Hugoen-usSun, 05 Jul 2026 00:00:00 +0000Orval OpenAPI Codegen Arbitrary Code Execution via Malicious Spec (CVE-2026-23947)https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23947-orval-codegen-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/misc/2026-07-05_cve-2026-23947-orval-codegen-rce/High severity — misc · CVE-2026-23947. Status: PoC. Affects: Orval (OpenAPI-to-TypeScript client generator), version 7.10.0. Tags: orval, openapi, code-generation, arbitrary-code-execution, nodejs, supply-chain, typescript, build-tooling.miscHighorvalopenapicode-generationarbitrary-code-executionnodejssupply-chaintypescriptbuild-toolingoRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-33331-orpc-openapi-stored-xss/High severity — web · CVE-2026-33331 (GHSA-7f6v-3gx7-27q8). Status: PoC. Affects: middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts). Tags: xss, stored-xss, orpc, openapi, cwe-79, javascript, nodejs, docs-page.webHighxssstored-xssorpcopenapicwe-79javascriptnodejsdocs-pagededoc/scramble Laravel API-Doc Generator Unauthenticated eval() RCE (CVE-2026-44262)https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44262-dedoc-scramble-eval-rce/Sun, 05 Jul 2026 00:00:00 +0000https://poc.intelseclab.com/pocs/web/2026-07-05_cve-2026-44262-dedoc-scramble-eval-rce/Critical severity — web · CVE-2026-44262 / [GHSA-4rm2-28vj-fj39](https://github.com/advisories/GHSA-4rm2-28vj-fj39). Status: PoC. Affects: [dedoc/scramble](https://github.com/dedoc/scramble) — Laravel API documentation generator. Tags: laravel, php, dedoc-scramble, eval-injection, rce, unauthenticated, api-documentation, openapi.webCriticallaravelphpdedoc-scrambleeval-injectionrceunauthenticatedapi-documentationopenapi