GitHub Advisoryadvisory · npm

GHSA-p239-93f7-h6xf Cross-Site Scripting in swagger-ui

CRITICAL Published 2020-09-01 Modified 2021-09-23 Official page ↗
Aliases
CVE-2016-5682
Ecosystem
npm
Packages
swagger-ui
Severity
Critical
Weaknesses
CWE-79
Reviewed
2020-08-31

Affected packages

• npm swagger-ui: < 2.2.1 → fixed in 2.2.1

Description

Affected versions of `swagger-ui` contain a cross-site scripting vulnerability in the key names of a specific nested object in the JSON document. Proof of Concept The vulnerable object structure is: ``` { "definitions": { "arbitraryVal": { "properties": { "": "LoremIpsum" } } } } ``` Malicious JSON documents can be loaded in by providing a URL to them in the `url` query string parameter. Recommendation Update to version 2.2.1 or later.

Related

Alias · CVE (1)

  • CVE-2016-5682 Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References