CVE-2016-1000226: Cross-Site Scripting in swagger-ui
Summary
CVE-2016-1000226: Cross-Site Scripting in swagger-ui. Affects swagger-ui versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Swagger UI is an open-source tool that allows developers to visualize and interact with the APIs defined in a Swagger JSON document. It provides a user-friendly interface for exploring and testing APIs. However, versions of swagger-ui prior to 2.2.1 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability affects both the consumes and produces parameters of the swagger JSON document for a given API. Additionally, swagger-ui allows users to load arbitrary swagger JSON documents via the query string parameter url, making it possible for an attacker to exploit this vulnerability by tricking users into visiting a crafted link.
Vulnerability Detail
The cross-site scripting vulnerability in swagger-ui allows an attacker to inject malicious code into the swagger JSON document, which is then executed in the context of the user's browser. This can lead to various attacks, such as stealing sensitive information, performing actions on behalf of the user, or modifying the appearance and behavior of the web page. The vulnerability can be exploited by convincing a user to visit a specially crafted link that loads a malicious swagger JSON document. The attacker can then execute arbitrary JavaScript code in the user's browser.
How To Fix
Latest published version: 5.34.0 as of 22 Oct 2026
npm install swagger-ui@5.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.1
This is the first release that contains the fix.
npm install swagger-ui@2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating swagger-ui is not immediately feasible, a temporary workaround is to manually sanitize the consumes and produces parameters of the swagger JSON document before rendering it in the UI. This can be done by implementing server-side input validation and sanitization to remove any potentially malicious code. Here is an example of how to sanitize the parameters in Node.js:
const sanitize = require('sanitize-html');
const swaggerJson = // load and parse the swagger JSON document;
swaggerJson.consumes = sanitize(swaggerJson.consumes);
swaggerJson.produces = sanitize(swaggerJson.produces);
// Render the sanitized swagger JSON document in the UI
Conclusion
The cross-site scripting vulnerability in swagger-ui can be mitigated by updating to version 2.2.1 or later. It is important to keep software dependencies up to date to ensure the security of your applications. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for swagger-ui →
FAQ
Swagger UI is an open-source tool that provides a user-friendly interface for exploring and testing APIs defined in a Swagger JSON document.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious code into web pages viewed by other users. In the case of swagger-ui, the XSS vulnerability allows an attacker to inject malicious code into the swagger JSON document, which is then executed in the context of the user's browser.
An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted link that loads a malicious swagger JSON document. The attacker can then execute arbitrary JavaScript code in the user's browser, potentially leading to various attacks such as stealing sensitive information or performing actions on behalf of the user.
Yes, updating swagger-ui to version 2.2.1 or later will fix this vulnerability. It is recommended to update the package to the latest version to ensure protection against this XSS vulnerability.
If updating swagger-ui is not immediately feasible, a temporary workaround is to manually sanitize the consumes and produces parameters of the swagger JSON document before rendering it in the UI. This can be done by implementing server-side input validation and sanitization to remove any potentially malicious code.
References
Related vulnerabilities
Recent vulnerabilities recorded for swagger-ui.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
