https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 08:42:27 +0000 https://db.gcve.eu/vuln/ghsa-7f59-x49p-v8mq <p><strong>Affected:</strong> npm: swagger-ui</p> <p>Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.</p> <p>Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.</p> <p>## Proof of Concept</p> <p>``` http://&lt;USER_HOSTNAME&gt;/swagger-ui/index.html?url=http://&lt;MALICIOUS_HOSTNAME&gt;/malicious-swagger-file.json ````</p> <p>## Recommendation</p> <p>Update to version 2.2.1 or later.</p> <p><strong>Affected:</strong> npm: swagger-ui</p> <p>Affected versions of `swagger-ui` are vulnerable to cross-site scripting in both the `consumes` and `produces` parameters of the swagger JSON document for a given API.</p> <p>Additionally, `swagger-ui` allows users to load arbitrary swagger JSON documents via the query string parameter `url`, allowing an attacker to exploit this attack against any user that the attacker can convince to visit a crafted link.</p> <p>## Proof of Concept</p> <p>``` http://&lt;USER_HOSTNAME&gt;/swagger-ui/index.html?url=http://&lt;MALICIOUS_HOSTNAME&gt;/malicious-swagger-file.json ````</p> <p>## Recommendation</p> <p>Update to version 2.2.1 or later.</p> https://db.gcve.eu/vuln/ghsa-7f59-x49p-v8mq https://db.gcve.eu/vuln/gsd-2016-1000226 gsd-2016-1000226 https://db.gcve.eu/vuln/gsd-2016-1000226