GitHub Advisoryadvisory · npm

GHSA-388g-jwpg-x6j4 Cross-Site Scripting in swagger-ui

MEDIUM Published 2020-09-11 Modified 2021-09-28 Official page ↗
Ecosystem
npm
Packages
swagger-ui
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm swagger-ui: < 3.0.13 → fixed in 3.0.13

Description

Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 3.0.13 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References