Cross-Site Scripting in swagger-ui

Published: Sep 11, 2020
Updated: Apr 14, 2023
GHSA: <a href="https://github.com/advisories/GHSA-388g-jwpg-x6j4" target="_blank" rel="noopener"> GHSA-388g-jwpg-x6j4
Severity: Medium
Exploit:

Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.