Vulnerability Database

296,746

Total vulnerabilities in the database

Cross-Site Scripting in swagger-ui

Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using <script> tags in the method descriptions.

Recommendation

Upgrade to version 2.2.1 or later.

Published: Sep 11, 2020
Updated: Apr 14, 2023
GHSA: GHSA-vp93-gcx5-4w52
Severity: Medium
Exploit:

No technical information available.

CWEs:

CWE-79

OWASP TOP 10:

A7 - Cross-Site Scripting (XSS)

Affected Software
References

Software	From	Fixed in
swagger-ui	-	2.2.1

https://github.com/swagger-api/swagger-ui/issues/1864
https://www.npmjs.com/advisories/986

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo