Описание
Cross-Site Scripting in swagger-ui
Versions of swagger-ui prior to 3.20.9 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize URLs used in the OAuth auth flow, which may allow attackers to execute arbitrary JavaScript.
Recommendation
Upgrade to version 3.20.9 or later.
Пакеты
Наименование
swagger-ui
npm
Затронутые версииВерсия исправления
< 3.20.9
3.20.9
6.5 Medium
CVSS3
Дефекты
CWE-79
6.5 Medium
CVSS3
Дефекты
CWE-79