swagger-api/swagger-ui · Security
Cross-Site Scripting in swagger-ui
- GHSA ID
- GHSA-w992-2gmj-9xxj
- Severity
- medium
- Published
- Updated
Description
Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 2.2.1 or later.
CWEs
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')