{"id":"GHSA-3244-8mff-w398","aliases":["GO-2023-1471"],"status":"published","title":"Reflected XSS in Gotify's /docs via import of outdated Swagger UI","description":"### Impact\n\nGotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files.\n\nSpecifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX.\n\nAn attacker can execute arbitrary JavaScript and potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify.\n\n### Patches\n\nThe vulnerability has been fixed in version 2.2.3.\n\n### References\n\nhttps://github.com/gotify/server/pull/541","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-01-10T22:48:43Z","modified":"2026-03-03T04:53:13Z","fixes":[{"ecosystem":"Go","package":"github.com/gotify/server","fixed_in":["2.2.3"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/gotify/server/v2","fixed_in":["2.2.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/gotify/server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.2.2"},{"fixed":"2.2.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gotify/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gotify/server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gotify/server/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.2.3"}]}]}],"references":[{"url":"https://github.com/gotify/server/security/advisories/GHSA-3244-8mff-w398","tags":["web","advisory"]},{"url":"https://github.com/gotify/server/pull/541","tags":["web","fix"]},{"url":"https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/"},{"url":"https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/"},{"url":"https://github.com/advisories/GHSA-3244-8mff-w398"},{"url":"https://github.com/gotify/server","tags":["package"]},{"url":"https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass","tags":["web"]},{"url":"https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-3244-8mff-w398","title":"Reflected XSS in Gotify's /docs via import of outdated Swagger UI","description":"### Impact\n\nGotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files.\n\nSpecifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX.\n\nAn attacker can execute arbitrary JavaScript and potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify.\n\n### Patches\n\nThe vulnerability has been fixed in version 2.2.3.\n\n### References\n\nhttps://github.com/gotify/server/pull/541","status":"published","published":"2023-01-10T22:48:43Z","modified":"2023-02-24T16:37:55Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:46.526285Z"}],"osv":[{"id":"GHSA-3244-8mff-w398","title":"Reflected XSS in Gotify's /docs via import of outdated Swagger UI","description":"### Impact\n\nGotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files.\n\nSpecifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX.\n\nAn attacker can execute arbitrary JavaScript and potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify.\n\n### Patches\n\nThe vulnerability has been fixed in version 2.2.3.\n\n### References\n\nhttps://github.com/gotify/server/pull/541","status":"published","published":"2023-01-10T22:48:43Z","modified":"2024-08-20T20:59:06.646301Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.050232Z"},{"id":"GO-2023-1471","title":"Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server","description":"Reflected XSS in Gotify's /docs via import of outdated Swagger UI in github.com/gotify/server","status":"published","published":"2024-08-20T20:25:58Z","modified":"2026-03-03T04:53:13.580774Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}