GHSA-388g-jwpg-x6j4
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 3.0.13 or later.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
What each source reports
GitHub Advisories Score used
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 3.0.13 or later.
- Record
GHSA-388g-jwpg-x6j4- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4f9m-pxwh-68hg
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 3.20.9 or later.
- Record
GHSA-4f9m-pxwh-68hg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x9p2-fxq6-2m5f
Reverse Tabnapping in swagger-ui
Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks.
Recommendation
Upgrade to version 3.18.0 or later.
- Record
GHSA-x9p2-fxq6-2m5f- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-1022
- Updated
- 2026-11-02
OSV
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 3.0.13 or later.
- Record
GHSA-388g-jwpg-x6j4- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-4f9m-pxwh-68hg
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 3.20.9 or later.
- Record
GHSA-4f9m-pxwh-68hg- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-x9p2-fxq6-2m5f
Reverse Tabnapping in swagger-ui
Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks.
Recommendation
Upgrade to version 3.18.0 or later.
- Record
GHSA-x9p2-fxq6-2m5f- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Weakness
- CWE-1022
- Updated
- 2026-11-02
OSVCLSA-2026-1786359305No score
TuxCare security update for swagger-ui (3 CVEs)
TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.2.
- Record
CLSA-2026-1786359305- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
swagger-uinpm | before 3.0.13 | 3.0.13 |
swagger-uinpm | before 3.20.9 | 3.20.9 |
swagger-uinpm | before 3.18.0 | 3.18.0 |
swagger-uiTuxCare:npm | 2.2.10-tuxcare.0 up to 2.2.10-tuxcare.2, plus listed versions 2.2.102.2.10-tuxcare.1 | 2.2.10-tuxcare.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-388g-jwpg-x6j4 is a medium vulnerability (CVSS 6.5) in swagger-ui, published June 20, 2019. No source lists public exploit code. Fixed in swagger-ui 3.0.13.
References
github.com/swagger-api/swagger-ui/issues/3163
snyk.io/vuln/SNYK-JS-SWAGGERUI-449941
npmjs.com/advisories/985
Show 9 moreShow less