Cross-Site Scripting Vulnerability in swagger-ui

swagger-ui Updated 02 Oct 2025

Summary

01/09/2020

Disclosed on

CRITICAL

Severity

Yes i

Fix available

Critical

Severity

Not published

CVSS Score

GHSA-g336-c7wv-8hp3: Cross-Site Scripting in swagger-ui. Affects swagger-ui versions < 2.2.1. Fixed in 2.2.1. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Swagger UI is a popular open-source tool that allows developers to visualize and interact with APIs. It provides a user-friendly interface for exploring and testing API endpoints. However, versions of swagger-ui prior to 2.2.1 are vulnerable to a cross-site scripting (XSS) attack. This vulnerability can be exploited through the 'url' query string parameter, allowing an attacker to inject malicious scripts into the application.

Vulnerability Detail

The cross-site scripting vulnerability in swagger-ui arises due to insufficient input validation and sanitization of the 'url' parameter. An attacker can craft a specially-crafted URL that includes malicious JavaScript code. When a user interacts with the vulnerable application and visits the manipulated URL, the injected code will be executed in the user's browser context. This can lead to various security risks, including session hijacking, data theft, and unauthorized actions on behalf of the user.

How To Fix

Latest published version: 5.34.0 as of 22 Oct 2026

npm install swagger-ui@5.34.0

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

2.2.1

This is the first release that contains the fix.

npm install swagger-ui@2.2.1

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

If updating swagger-ui is not immediately feasible, a temporary workaround is to manually sanitize and validate the 'url' parameter before processing it. This can be done by implementing server-side input validation and sanitization techniques, such as HTML entity encoding or using a dedicated library for input sanitization. However, it is crucial to note that workarounds may not provide complete protection and should be considered as a temporary solution until the package is updated.

Conclusion

The cross-site scripting vulnerability in swagger-ui can have severe security implications, allowing attackers to execute arbitrary code in users' browsers. It is crucial to update the package to version 2.2.1 or later to mitigate this vulnerability. If immediate updating is not possible, implementing server-side input validation and sanitization techniques can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for swagger-ui →

FAQ

What is cross-site scripting (XSS)?

Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. It occurs when an application does not properly validate and sanitize user input, allowing the execution of arbitrary code in the victim's browser.

How can the swagger-ui XSS vulnerability be exploited?

The swagger-ui XSS vulnerability can be exploited by crafting a URL with a malicious payload in the 'url' query string parameter. When a user interacts with the vulnerable application and visits the manipulated URL, the injected code will be executed in their browser, potentially leading to unauthorized actions or data theft.

What are the potential consequences of the swagger-ui XSS vulnerability?

The potential consequences of the swagger-ui XSS vulnerability include session hijacking, data theft, unauthorized actions on behalf of the user, defacement of the application, and the spread of malware or phishing attacks.

Is there a fix available for the swagger-ui XSS vulnerability?

Yes, the vulnerability can be fixed by updating swagger-ui to version 2.2.1 or later. It is recommended to promptly apply the update to ensure the application is protected against this XSS vulnerability.

Are there any workarounds available for the swagger-ui XSS vulnerability?

While updating swagger-ui is the recommended solution, a temporary workaround is to implement server-side input validation and sanitization techniques for the 'url' parameter. This can help mitigate the risk of XSS attacks until the package is updated.