Skip to content
OpenAdvisories

Package · npm

swagger-ui

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical —
    GHSA-g336-c7wv-8hp3

    Cross-Site Scripting in swagger-ui

    Affected versions of `swagger-ui` are vulnerable to cross-site scripting via the `url` query string parameter. ## Recommendation Update to 2.2.1 or later.

    swagger-ui npm
  • Critical —
    CVE-2016-1000226

    Cross-Site Scripting in swagger-ui

    Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API. Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the qu…

    swagger-ui npm
  • Critical 9.8
    CVE-2019-17495 Public exploit

    Cross-site scripting in Swagger-UI

    A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other w…

    swagger-ui org.webjars:swagger-ui org.webjars.npm:swagger-ui io.springfox:springfox-swagger-ui npm Maven
  • Critical —
    CVE-2016-5682

    Cross-Site Scripting in swagger-ui

    Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.

    swagger-ui npm