{"id":"GHSA-388g-jwpg-x6j4","aliases":["CLSA-2026-1786359305","GHSA-4f9m-pxwh-68hg","GHSA-x9p2-fxq6-2m5f"],"status":"published","title":"Cross-Site Scripting in swagger-ui","description":"Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nUpgrade to version 3.0.13 or later.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1022","CWE-79"],"published":"2019-06-20T14:33:07Z","modified":"2026-10-15T09:45:59Z","fixes":[{"ecosystem":"npm","package":"swagger-ui","fixed_in":["3.0.13","3.20.9","3.18.0"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"swagger-ui","fixed_in":["2.2.10-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.13"}]}]},{"source":"ghsa","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.9"}]}]},{"source":"ghsa","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.0"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"swagger-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.10-tuxcare.0"},{"fixed":"2.2.10-tuxcare.2"}]}],"versions":["2.2.10","2.2.10-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.0.13"}]}]},{"source":"osv","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.20.9"}]}]},{"source":"osv","ecosystem":"npm","package":"swagger-ui","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.18.0"}]}]}],"references":[{"url":"https://github.com/swagger-api/swagger-ui/issues/3163","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-SWAGGERUI-449941","tags":["web"]},{"url":"https://www.npmjs.com/advisories/985","tags":["web"]},{"url":"https://github.com/advisories/GHSA-388g-jwpg-x6j4"},{"url":"https://github.com/swagger-api/swagger-ui/pull/5190","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-SWAGGERUI-449921","tags":["web"]},{"url":"https://github.com/swagger-api/swagger-ui/commit/1e184e8e218676278c83e60a45846c199ce3d15e","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4f9m-pxwh-68hg"},{"url":"https://github.com/swagger-api/swagger-ui/pull/4789","tags":["web"]},{"url":"https://github.com/swagger-api/swagger-ui/commit/3f4cae3334fdd492a373f4453bd03a9ebd87becf","tags":["web"]},{"url":"https://github.com/swagger-api/swagger-ui/releases/tag/v3.18.0","tags":["web"]},{"url":"https://snyk.io/vuln/SNYK-JS-SWAGGERUI-449808","tags":["web"]},{"url":"https://www.npmjs.com/advisories/975","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x9p2-fxq6-2m5f"},{"url":"https://github.com/swagger-api/swagger-ui","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-388g-jwpg-x6j4","title":"Cross-Site Scripting in swagger-ui","description":"Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nUpgrade to version 3.0.13 or later.","status":"published","published":"2020-09-11T21:20:14Z","modified":"2023-01-09T05:03:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:06.884904Z"},{"id":"GHSA-4f9m-pxwh-68hg","title":"Cross-Site Scripting in swagger-ui","description":"Versions of `swagger-ui` prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nUpgrade to version 3.20.9 or later.","status":"published","published":"2020-09-11T21:20:14Z","modified":"2023-10-02T16:28:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:37:07.641671Z"},{"id":"GHSA-x9p2-fxq6-2m5f","title":"Reverse Tabnapping in swagger-ui","description":"Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nUpgrade to version 3.18.0 or later.","status":"published","published":"2019-06-20T14:33:07Z","modified":"2023-01-09T05:01:43Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-1022"],"updated_at":"2026-11-02T14:36:02.073372Z"}],"osv":[{"id":"GHSA-388g-jwpg-x6j4","title":"Cross-Site Scripting in swagger-ui","description":"Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nUpgrade to version 3.0.13 or later.","status":"published","published":"2020-09-11T21:20:14Z","modified":"2021-09-28T17:00:22Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:35.406455Z"},{"id":"GHSA-4f9m-pxwh-68hg","title":"Cross-Site Scripting in swagger-ui","description":"Versions of `swagger-ui` prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nUpgrade to version 3.20.9 or later.","status":"published","published":"2020-09-11T21:20:14Z","modified":"2021-09-28T16:57:07Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"GHSA-x9p2-fxq6-2m5f","title":"Reverse Tabnapping in swagger-ui","description":"Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nUpgrade to version 3.18.0 or later.","status":"published","published":"2019-06-20T14:33:07Z","modified":"2021-08-16T23:44:47Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-1022"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"CLSA-2026-1786359305","title":"TuxCare security update for swagger-ui (3 CVEs)","description":"TuxCare rebuilt swagger-ui to address 3 CVEs. Fixed in 2.2.10-tuxcare.2.","status":"published","published":"2026-08-10T10:55:05Z","modified":"2026-10-15T09:45:59.842389639Z","updated_at":"2026-11-02T15:43:46.850893Z"}]}}