Cross-Site Scripting in swagger-ui (GHSA-4f9m-pxwh-68hg)

Description

Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.

Recommendation

Update the swagger-ui package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.20.9
• Patched version(s): 3.20.9

References

• GHSA-4f9m-pxwh-68hg
• snyk.io
• CWE-79
• OWASP 2021-A3

Related Issues

• Cross-Site Scripting in swagger-ui (GHSA-p239-93f7-h6xf) - CVE-2016-5682
• Cross-Site Scripting in swagger-ui (GHSA-vp93-gcx5-4w52) - Vulnerability
• Cross-Site Scripting in swagger-ui (GHSA-w992-2gmj-9xxj) - Vulnerability
• Cross-Site Scripting in swagger-ui (GHSA-22q9-hqm5-mhmc) - Vulnerability

Tags:

npm

swagger-ui