oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards

#!/usr/bin/env python3
# verify_orpc_cve_2026_28794.py
# Detect vulnerable @orpc/client versions for CVE-2026-28794.
# Usage: python3 verify_orpc_cve_2026_28794.py /path/to/app
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN, 3 usage/error

import json
import os
import re
import sys
from typing import Optional, Tuple, List

PKG = '@orpc/client'
FIXED = (1, 13, 6)

SEMVER_RE = re.compile(r'^(\d+)\.(\d+)\.(\d+)')


def parse_ver(v: str) -> Optional[Tuple[int, int, int]]:
    if not v:
        return None
    v = v.strip()
    if v.startswith('v'):
        v = v[1:]
    m = SEMVER_RE.match(v)
    if not m:
        return None
    return tuple(int(x) for x in m.groups())


def cmp_ver(a: Tuple[int, int, int], b: Tuple[int, int, int]) -> int:
    return (a > b) - (a < b)


def classify(v: str) -> str:
    pv = parse_ver(v)
    if pv is None:
        return 'UNKNOWN'
    return 'PATCHED' if cmp_ver(pv, FIXED) >= 0 else 'VULNERABLE'


def load_json(path: str):
    try:
        with open(path, 'r', encoding='utf-8') as f:
            return json.load(f)
    except Exception:
        return None


def check_package_lock(root: str, findings: List[str]) -> Optional[str]:
    path = os.path.join(root, 'package-lock.json')
    data = load_json(path)
    if not data:
        return None

    # npm v7+ package-lock structure
    packages = data.get('packages', {})
    node = packages.get(f'node_modules/{PKG}')
    if isinstance(node, dict) and 'version' in node:
        version = str(node['version'])
        findings.append(f'package-lock.json: {PKG}={version}')
        return classify(version)

    # npm v6 structure
    def walk_deps(dep_obj):
        if not isinstance(dep_obj, dict):
            return None
        for name, meta in dep_obj.items():
            if name == PKG and isinstance(meta, dict) and 'version' in meta:
                return str(meta['version'])
            if isinstance(meta, dict):
                child = walk_deps(meta.get('dependencies', {}))
                if child:
                    return child
        return None

    version = walk_deps(data.get('dependencies', {}))
    if version:
        findings.append(f'package-lock.json: {PKG}={version}')
        return classify(version)
    return None


def check_pnpm_lock(root: str, findings: List[str]) -> Optional[str]:
    path = os.path.join(root, 'pnpm-lock.yaml')
    if not os.path.isfile(path):
        return None
    try:
        with open(path, 'r', encoding='utf-8') as f:
            text = f.read()
    except Exception:
        return None

    patterns = [
        re.compile(rf'^[\t ]*/{re.escape(PKG)}@(\d+\.\d+\.\d+):', re.M),
        re.compile(rf'^[\t ]*{re.escape(PKG)}@(\d+\.\d+\.\d+):', re.M),
    ]
    for pat in patterns:
        m = pat.search(text)
        if m:
            version = m.group(1)
            findings.append(f'pnpm-lock.yaml: {PKG}={version}')
            return classify(version)
    return None


def check_yarn_lock(root: str, findings: List[str]) -> Optional[str]:
    path = os.path.join(root, 'yarn.lock')
    if not os.path.isfile(path):
        return None
    try:
        with open(path, 'r', encoding='utf-8') as f:
            text = f.read()
    except Exception:
        return None

    pat = re.compile(rf'"?{re.escape(PKG)}@[^\n]+:\n(?:  .*\n)*?  version "(\d+\.\d+\.\d+)"', re.M)
    m = pat.search(text)
    if m:
        version = m.group(1)
        findings.append(f'yarn.lock: {PKG}={version}')
        return classify(version)
    return None


def check_node_modules(root: str, findings: List[str]) -> Optional[str]:
    path = os.path.join(root, 'node_modules', '@orpc', 'client', 'package.json')
    data = load_json(path)
    if isinstance(data, dict) and 'version' in data:
        version = str(data['version'])
        findings.append(f'node_modules: {PKG}={version}')
        return classify(version)
    return None


def aggregate(results: List[Optional[str]]) -> str:
    present = [r for r in results if r is not None]
    if not present:
        return 'UNKNOWN'
    if 'VULNERABLE' in present:
        return 'VULNERABLE'
    if 'PATCHED' in present and all(r == 'PATCHED' for r in present):
        return 'PATCHED'
    return 'UNKNOWN'


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 verify_orpc_cve_2026_28794.py /path/to/app')
        sys.exit(3)

    root = sys.argv[1]
    if not os.path.isdir(root):
        print(f'UNKNOWN - path not found: {root}')
        sys.exit(3)

    findings: List[str] = []
    results = [
        check_package_lock(root, findings),
        check_pnpm_lock(root, findings),
        check_yarn_lock(root, findings),
        check_node_modules(root, findings),
    ]
    verdict = aggregate(results)

    if findings:
        print('; '.join(findings))

    if verdict == 'VULNERABLE':
        print(f'VULNERABLE - {PKG} version earlier than 1.13.6 detected')
        sys.exit(1)
    elif verdict == 'PATCHED':
        print(f'PATCHED - {PKG} version 1.13.6 or later detected')
        sys.exit(0)
    else:
        print(f'UNKNOWN - could not confirm installed {PKG} version from lockfiles or node_modules')
        sys.exit(2)


if __name__ == '__main__':
    main()