Vulnerability Database

313,825

Total vulnerabilities in the database

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.

Recommendation

Upgrade to version 3.20.9 or later.

Published: Sep 11, 2020
Updated: Apr 14, 2023
GHSA: GHSA-4f9m-pxwh-68hg
Severity: Medium
Exploit:

CVSS v3:

Severity: Unknown
Score:
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
swagger-ui	-	3.20.9

https://github.com/swagger-api/swagger-ui/pull/5190
https://snyk.io/vuln/SNYK-JS-SWAGGERUI-449921
https://www.npmjs.com/advisories/976

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo