https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-04T08:42:25.601968+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/ghsa-7f59-x49p-v8mq GHSA-7f59-x49p-v8mq — Cross-Site Scripting in swagger-ui 2026-10-04T08:42:25.621244+00:00

Affected: npm: swagger-ui

Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.

Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.

## Proof of Concept

``` http://<USER_HOSTNAME>/swagger-ui/index.html?url=http://<MALICIOUS_HOSTNAME>/malicious-swagger-file.json ````

## Recommendation

Update to version 2.2.1 or later.

 https://db.gcve.eu/vuln/gsd-2016-1000226 gsd-2016-1000226 2026-10-04T08:42:25.621311+00:00 gsd-2016-1000226