Cross-Site Scripting in swagger-ui
Summary
GHSA-vp93-gcx5-4w52: Cross-Site Scripting in swagger-ui. Affects swagger-ui versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Swagger UI is a popular open-source tool that allows developers to visualize and interact with APIs. It provides a user-friendly interface for exploring and testing API endpoints. However, versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS) attacks. This means that an attacker can inject malicious JavaScript code into the application, potentially leading to unauthorized access, data theft, or other malicious activities.
Vulnerability Detail
The vulnerability in swagger-ui arises from a failure to properly sanitize JSON schemas. This allows attackers to execute arbitrary JavaScript code by injecting it into the method descriptions using <script> tags. When a user interacts with the affected API documentation, the injected code gets executed in their browser, giving the attacker control over the user's session and potentially exposing sensitive information.
How To Fix
Latest published version: 5.34.0 as of 22 Oct 2026
npm install swagger-ui@5.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.1
This is the first release that contains the fix.
npm install swagger-ui@2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the JSON schemas before rendering them in swagger-ui. This can be done by implementing a sanitization function that removes any potentially malicious code from the schemas. Here's an example of how the sanitization function can be implemented in JavaScript:
function sanitizeSchema(schema) {
// Remove any <script> tags from the schema
const sanitizedSchema = schema.replace(/<script.*?>.*?</script>/gi, '');
return sanitizedSchema;
}
By applying this sanitization function to the JSON schemas before passing them to swagger-ui, you can mitigate the risk of XSS attacks.
Conclusion
Cross-Site Scripting (XSS) vulnerabilities can have serious consequences for the security and integrity of your application. It is crucial to promptly address and fix such vulnerabilities to protect your users and their data. Upgrading to the latest version of swagger-ui or implementing the provided workaround will help mitigate the risk of XSS attacks. If you need further assistance or support in resolving this vulnerability, please reach out to DevNack.com.
See every vulnerability recorded for swagger-ui →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate website content, or perform other malicious actions.
If your application uses swagger-ui versions prior to 2.2.1, it is vulnerable to XSS attacks. An attacker can inject malicious JavaScript code into the method descriptions, which will be executed when users interact with the API documentation. This can lead to unauthorized access, data theft, or other malicious activities.
The recommended solution is to upgrade to version 2.2.1 or later of swagger-ui. This version includes proper sanitization of JSON schemas, preventing the execution of arbitrary JavaScript code. By updating to the latest version, you can protect your application against XSS attacks.
Yes, if upgrading to the latest version is not immediately feasible, you can manually sanitize the JSON schemas before rendering them in swagger-ui. By implementing a sanitization function that removes any potentially malicious code from the schemas, you can mitigate the risk of XSS attacks. Refer to the 'workaround' section for an example of how to implement the sanitization function.
You can find more information about this vulnerability, including the affected versions and the fix, in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-vp93-gcx5-4w52/GHSA-vp93-gcx5-4w52.json
References
Related vulnerabilities
Recent vulnerabilities recorded for swagger-ui.
