CVE-2017-1000207: Deserialization of Untrusted Data in swagger-codegen
Summary
CVE-2017-1000207: Deserialization of Untrusted Data in swagger-codegen. Affects io.swagger:swagger-parser versions < 1.0.31. Fixed in 1.0.31. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is Swagger-Parser, with a version <= 1.0.30, and Swagger codegen with a version <= 2.2.2. Swagger-Parser is a library that parses Swagger/OpenAPI specifications and provides a representation of the API structure. Swagger codegen is a tool that generates client libraries, server stubs, and API documentation from Swagger/OpenAPI specifications. This vulnerability affects the yaml parsing functionality of both packages. The vulnerability allows for arbitrary code execution when a maliciously crafted yaml Open-API specification is parsed. Specifically, the 'generate' and 'validate' commands in swagger-codegen (<= 2.2.2) are susceptible to executing arbitrary code when used with a well-crafted yaml specification.
Vulnerability Detail
The vulnerability arises from a flaw in the yaml parsing functionality of Swagger-Parser and Swagger codegen. When a maliciously crafted yaml Open-API specification is parsed, it triggers the deserialization of untrusted data, leading to the execution of arbitrary code. This can have severe consequences, as an attacker can exploit this vulnerability to execute arbitrary commands or gain unauthorized access to the system. The vulnerability has a CVSS score of 8.8, indicating a high severity level.
How To Fix
Latest published version: 2.0.0-rc1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.31
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the affected packages to the fixed versions mentioned above.
Conclusion
In conclusion, the vulnerability in Swagger-Parser and Swagger codegen allows for the execution of arbitrary code when parsing a maliciously crafted yaml Open-API specification. To mitigate this vulnerability, it is crucial to update the affected packages to the fixed versions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for io.swagger:swagger-parser →
FAQ
Swagger-Parser is a library that parses Swagger/OpenAPI specifications and provides a representation of the API structure.
Swagger codegen is a tool that generates client libraries, server stubs, and API documentation from Swagger/OpenAPI specifications.
YAML parsing is the process of interpreting and extracting data from YAML (YAML Ain't Markup Language) files, which are commonly used for configuration and data serialization purposes.
The vulnerability allows for arbitrary code execution, which can lead to various consequences such as unauthorized access, data breaches, and remote code execution.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
