GitHub Advisoryadvisory · npm

GHSA-4f9m-pxwh-68hg Cross-Site Scripting in swagger-ui

MEDIUM Published 2020-09-11 Modified 2021-09-28 Official page ↗
Ecosystem
npm
Packages
swagger-ui
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm swagger-ui: < 3.20.9 → fixed in 3.20.9

Description

Versions of `swagger-ui` prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. Recommendation Upgrade to version 3.20.9 or later.

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References