Skip to content
OpenAdvisories

Package · npm

swagger-ui

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 4.3
    CVE-2018-25031 Public exploit EPSS 42%

    Spoofing attack in swagger-ui

    Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be r…

    swagger-ui org.webjars:swagger-ui npm Maven
  • Medium —
    GHSA-qrmm-w75w-3wpx

    Server side request forgery in SwaggerUI

    SwaggerUI supports displaying remote OpenAPI definitions through the `?url` parameter. This enables robust demonstration capabilities on sites like `petstore.swagger.io`, `editor.swagger.io`, and similar sites, where users often want to see what their OpenAPI…

    swagger-ui swagger-ui-dist swagger-ui-react Swashbuckle.AspNetCore.SwaggerUI npm NuGet
  • Medium —
    GHSA-w992-2gmj-9xxj

    Cross-Site Scripting in swagger-ui

    Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the `swagger.apiInfo.description` value without proper sanitization, which may allow attackers to execute arbitrary JavaScript. ## Recommenda…

    swagger-ui npm
  • Medium —
    GHSA-22q9-hqm5-mhmc

    Cross-Site Scripting in swagger-ui

    Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to encode output in GET requests. The request is meant to respond with Content-Type `application/json` which does not trigger the vulnerability but if the …

    swagger-ui npm
  • Medium —
    GHSA-vp93-gcx5-4w52

    Cross-Site Scripting in swagger-ui

    Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize JSON schemas, allowing attackers to execute arbitrary JavaScript using `<script>` tags in the method descriptions. ## Recommendation Upgrade to…

    swagger-ui npm
  • Medium 6.5
    GHSA-4f9m-pxwh-68hg

    Cross-Site Scripting in swagger-ui

    Versions of `swagger-ui` prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version 3.20.9 or la…

    swagger-ui npm
  • Medium 6.5
    GHSA-388g-jwpg-x6j4

    Cross-Site Scripting in swagger-ui

    Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript. ## Recommendation Upgrade to version…

    swagger-ui npm
  • Medium 6.1
    CVE-2016-1000229 Public exploit

    Improper Neutralization of Input During Web Page Generation in swagger-ui

    swagger-ui has XSS in key names

    swagger-ui npm
  • Medium 4.3
    GHSA-x9p2-fxq6-2m5f

    Reverse Tabnapping in swagger-ui

    Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is…

    swagger-ui npm