GMS-2016-42: XSS in Consumes/Produces Parameter

July 20, 2016

Swagger-UI contains a cross site scripting (XSS) vulnerability in the consumes and produces parameters of the swagger JSON document for a given API. A maliciously crafted swagger JSON doc can be loaded via the URL query-string parameter url.

References

github.com/swagger-api/swagger-ui/issues/1866
github.com/swagger-api/swagger-ui/pull/1867

Code Behaviors & Features

Detect and mitigate GMS-2016-42 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →