CVE-2016-1000233: Cross-Site Scripting in swagger-ui
Summary
CVE-2016-1000233: Cross-Site Scripting in swagger-ui. Affects swagger-ui versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Swagger UI is an open-source tool that allows developers to visualize and interact with the APIs defined in their Swagger specification. It provides a user-friendly interface for exploring and testing APIs. However, versions of swagger-ui prior to 2.2.1 are vulnerable to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability in swagger-ui arises from its automatic execution of external JavaScript when a Content-Type: application/javascript header is included in the response. An attacker can exploit this by creating a server that responds with a malicious script and the appropriate content-type. They can then craft a swagger-ui URL that includes the location of their server/script in the url query string parameter. When a user views this link, the attacker's script will be executed, potentially leading to unauthorized actions or data theft.
How To Fix
Latest published version: 5.34.0 as of 22 Oct 2026
npm install swagger-ui@5.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.1
This is the first release that contains the fix.
npm install swagger-ui@2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched version of swagger-ui to mitigate the risk of XSS attacks.
Conclusion
The vulnerability in swagger-ui allows for cross-site scripting attacks, which can have severe consequences for the security and integrity of web applications. It is recommended to update to swagger-ui version 2.2.1 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for swagger-ui →
FAQ
Swagger UI is an open-source tool that provides a user-friendly interface for exploring and testing APIs defined in a Swagger specification.
Cross-site scripting is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized actions or data theft.
The vulnerability in swagger-ui occurs because it automatically executes external JavaScript when a specific content-type header is included in the response. Attackers can exploit this behavior by crafting a URL that includes a malicious script, which will be executed when the link is viewed.
This vulnerability allows attackers to execute arbitrary JavaScript code in the context of a user's browser. This can lead to unauthorized actions, data theft, or the manipulation of displayed content.
To protect your application, it is crucial to update swagger-ui to version 2.2.1 or later. This update includes a fix for the XSS vulnerability and prevents the automatic execution of external JavaScript.
References
Related vulnerabilities
Recent vulnerabilities recorded for swagger-ui.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.