Cross-Site Scripting in swagger-ui

Published: Sep 11, 2020
Updated: Apr 14, 2023
GHSA: <a href="https://github.com/advisories/GHSA-4f9m-pxwh-68hg" target="_blank" rel="noopener"> GHSA-4f9m-pxwh-68hg
Severity: Medium
Exploit:

Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.