GHSA-w992-2gmj-9xxj
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 2.2.1 or later.
What each source reports
GitHub AdvisoriesNo score
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 2.2.1 or later.
- Record
GHSA-w992-2gmj-9xxj- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package allows HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 2.2.1 or later.
- Record
GHSA-w992-2gmj-9xxj- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
swagger-uinpm | before 2.2.1 | 2.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-w992-2gmj-9xxj is a vulnerability with no CVSS score yet in swagger-ui, published September 11, 2020. No source lists public exploit code. Fixed in swagger-ui 2.2.1.