CVE-2021-36686: Cross-site Scripting in yapi-vendor

yapi-vendor Updated 02 Oct 2025

Summary

26/01/2023

Disclosed on

CVE-2021-36686

CVE

No i

Fix available

Moderate

Severity

5.4

CVSS Score

CVE-2021-36686: Cross-site Scripting in yapi-vendor. Affects yapi-vendor versions < 1.9.1. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

yapi-vendor is an npm package that is part of the yapi ecosystem. It is used for managing and interacting with APIs. The package allows users to create, edit, and delete APIs through an interface. However, version 1.9.1 of yapi-vendor is vulnerable to a Cross-site Scripting (XSS) attack.

Vulnerability Detail

The vulnerability in yapi-vendor version 1.9.1 allows attackers to execute arbitrary code through the /interface/api edit page. This means that an attacker can inject malicious scripts into the page, which will be executed by the victim's browser. This can lead to various consequences, such as stealing sensitive information, modifying the page content, or performing actions on behalf of the victim.

How To Fix

No fixed version is published for this vulnerability.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

There is no known workaround for this vulnerability. It is essential to update to the latest non-vulnerable version of yapi-vendor to mitigate the risk.

Conclusion

In conclusion, yapi-vendor version 1.9.1 is vulnerable to a Cross-site Scripting (XSS) attack. To mitigate this vulnerability, users should update to the latest non-vulnerable version of yapi-vendor. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for yapi-vendor →