GHSA-mrx7-8hxf-f853
Cross-Site Scripting in swagger-ui
Quick fix
GHSA-mrx7-8hxf-f853 — swagger-ui: upgrade to the fixed version with the command below.
npm install swagger-ui@2.2.1Details
Affected versions of `swagger-ui` are vulnerable to cross-site scripting. This vulnerability exists because `swagger-ui` automatically executes external Javascript that is loaded in via the `url` query string parameter when a `Content-Type: application/javascript` header is included.
An attacker can create a server that replies with a malicious script and the proper content-type, and then craft a `swagger-ui` URL that includes the location to their server/script in the `url` query string parameter. When viewed, such a link would execute the attacker's malicious script.
## Recommendation
Update to 2.2.1 or later.
Are you affected?
Enter the version of the package you're using.