Cross-Site Scripting (XSS) Vulnerability in swagger-ui
Summary
GHSA-w992-2gmj-9xxj: Cross-Site Scripting in swagger-ui. Affects swagger-ui versions < 2.2.1. Fixed in 2.2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Swagger UI is a popular open-source tool for visualizing and interacting with API specifications. It provides a user-friendly interface for developers to explore and test APIs. However, versions prior to 2.2.1 of the swagger-ui package are vulnerable to Cross-Site Scripting (XSS) attacks. This vulnerability arises from a lack of proper sanitization of HTML code in the swagger.apiInfo.description value. Attackers can exploit this vulnerability to execute arbitrary JavaScript code.
Vulnerability Detail
The Cross-Site Scripting (XSS) vulnerability in swagger-ui allows attackers to inject malicious JavaScript code into the application. This can lead to various security risks, such as stealing sensitive user information, manipulating user sessions, or performing actions on behalf of the user. The vulnerability arises from the package's failure to properly sanitize user-provided HTML code in the swagger.apiInfo.description field. As a result, an attacker can craft a payload that will be executed by the victim's browser when viewing the API documentation.
How To Fix
Latest published version: 5.34.0 as of 22 Oct 2026
npm install swagger-ui@5.34.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.2.1
This is the first release that contains the fix.
npm install swagger-ui@2.2.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to manually sanitize the swagger.apiInfo.description value before rendering it in the Swagger UI. This can be done using a library or function that escapes or removes any HTML tags and special characters. Here's an example of how to sanitize the value using the he library:
const he = require('he');
const sanitizedDescription = he.encode(apiInfo.description);
Conclusion
The Cross-Site Scripting (XSS) vulnerability in swagger-ui versions prior to 2.2.1 can allow attackers to execute arbitrary JavaScript code. To mitigate this risk, it is crucial to upgrade to the latest version of the package or apply proper sanitization to user-provided HTML code. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for swagger-ui →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, manipulate user sessions, or perform actions on behalf of the user.
If your application uses an older version of the swagger-ui package, it is vulnerable to XSS attacks. An attacker can exploit this vulnerability to execute arbitrary JavaScript code in the context of your application's users, potentially leading to unauthorized access, data theft, or other malicious activities.
Yes, the vulnerability can be fixed by upgrading to version 2.2.1 or later of the swagger-ui package. This version includes proper sanitization of user-provided HTML code, preventing XSS attacks.
If upgrading is not immediately feasible, you can manually sanitize the swagger.apiInfo.description value before rendering it in the Swagger UI. This involves removing or escaping any HTML tags and special characters to prevent the execution of malicious scripts.
You can find more information about the vulnerability in the GitHub Security Advisory database. Visit the following link for details: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-w992-2gmj-9xxj/GHSA-w992-2gmj-9xxj.json
References
Related vulnerabilities
Recent vulnerabilities recorded for swagger-ui.
