swagger-ui-2.1.2.min.js: 12 vulnerabilities (highest severity is: 9.8) #6

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

CVE-2019-17495

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@⁠import within the JSON data was a functional attack method.

Publish Date: 2019-10-10

URL: CVE-2019-17495

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: GHSA-c427-hjc3-wrfw

Release Date: 2019-10-10

Fix Resolution: swagger-ui - 3.23.11

CVE-2016-1000226

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

Affected versions of "swagger-ui" are vulnerable to cross-site scripting in both the "consumes" and "produces" parameters of the swagger JSON document for a given API. Additionally, "swagger-ui" allows users to load arbitrary swagger JSON documents via the query string parameter "url", allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.

Publish Date: 2026-05-14

URL: CVE-2016-1000226

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: GHSA-7f59-x49p-v8mq

Release Date: 2026-05-14

Fix Resolution: swagger-ui - 2.2.1

WS-2019-0172

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

swagger-ui before 3.20.9 fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript. that leads to Cross-Site Scripting

Publish Date: 2026-05-27

URL: WS-2019-0172

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

CVE-2016-1000233

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

Affected versions of "swagger-ui" are vulnerable to cross-site scripting. This vulnerability exists because "swagger-ui" automatically executes external Javascript that is loaded in via the "url" query string parameter when a "Content-Type: application/javascript" header is included. An attacker can create a server that replies with a malicious script and the proper content-type, and then craft a "swagger-ui" URL that includes the location to their server/script in the "url" query string parameter. When viewed, such a link would execute the attacker's malicious script.

Publish Date: 2026-05-19

URL: CVE-2016-1000233

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-mrx7-8hxf-f853

Release Date: 2025-07-30

Fix Resolution: swagger-ui - 2.2.1

WS-2019-0236

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

swagger-ui versions before 3.0.13 are vulnerable to XSS when it fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.

Publish Date: 2026-05-14

URL: WS-2019-0236

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://www.mend.io/vulnerability-database/WS-2019-0236

Release Date: 2026-05-14

Fix Resolution: swagger-ui - 3.0.13

WS-2019-0235

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

swagger-ui versions before 2.2.1 are vulnerable to XSS when it fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to text/html it may allow attackers to execute arbitrary JavaScript.

Publish Date: 2026-05-14

URL: WS-2019-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://www.mend.io/vulnerability-database/WS-2019-0235

Release Date: 2026-05-14

Fix Resolution: swagger-ui - 2.2.0

WS-2019-0234

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

swagger-ui versions before 2.2.1 are vulnerable to XSS when allowing HTML code in the swagger.apiInfo.description value without proper sanitization, which may allow attackers to execute arbitrary JavaScript.

Publish Date: 2026-05-19

URL: WS-2019-0234

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

CVE-2016-5682

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

Swagger-UI before 2.2.1 has XSS via the Default field in the Definitions section.

Publish Date: 2017-04-10

URL: CVE-2016-5682

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-p239-93f7-h6xf

Release Date: 2017-04-10

Fix Resolution: swagger-ui - 2.2.1

CVE-2016-1000239

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

swagger-ui versions before 2.2.1 vulnerable to cross-site scripting via the url query string parameter.

Publish Date: 2026-05-19

URL: CVE-2016-1000239

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

CVE-2016-1000229

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

swagger-ui has XSS in key names

Publish Date: 2019-12-20

URL: CVE-2016-1000229

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-h8wp-wgcq-qhrf

Release Date: 2019-12-20

Fix Resolution: swagger-ui - 2.2.1

WS-2019-0171

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

swagger-ui before 3.18.0 has Reverse Tabnapping vulnerability. using target='_blank' in anchor tags, allowing attackers to access window.opener for the original page.

Publish Date: 2026-05-14

URL: WS-2019-0171

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://www.mend.io/vulnerability-database/WS-2019-0171

Release Date: 2026-05-14

Fix Resolution: swagger-ui - 3.18.0

CVE-2018-25031

Vulnerable Library - swagger-ui-2.1.2.min.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/2.1.2/swagger-ui.min.js

Dependency Hierarchy:

• ❌ swagger-ui-2.1.2.min.js (Vulnerable Library)

Found in HEAD commit: b92e03b0ad766a7785ba609b8861dcc93c908c6a

Found in base branch: AltoroJ-3.2

Vulnerability Details

Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions. Note: This was originally claimed to be resolved in 4.1.3. However, third parties have indicated this is not resolved in 4.1.3 and even occurs in that version and possibly others.

Publish Date: 2022-03-11

URL: CVE-2018-25031

CVSS 3 Score Details (4.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-cr3q-pqgq-m8c2

Release Date: 2022-03-11

Fix Resolution: swagger-ui - 4.1.3