MAL-2026-5636 Malicious code in swagger-express-routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 342bf1e361c6684c276c1afc618d78d82268e93898daddaef74873a49c6111b2 On require'swagger-express-routes', the package's main entry transitively loads src/utils/lib.min.js through src/connector/index.js line 1:...

Malicious code in swagger-express-routes (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 342bf1e361c6684c276c1afc618d78d82268e93898daddaef74873a49c6111b2 On require'swagger-express-routes', the package's main entry transitively loads src/utils/lib.min.js through src/connector/index.js line 1:...

Malicious Package

Overview swagger-express-routes is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

CVE-2016-1000226

Affected versions of "swagger-ui" are vulnerable to cross-site scripting in both the "consumes" and "produces" parameters of the swagger JSON document for a given API. Additionally, "swagger-ui" allows users to load arbitrary swagger JSON documents via the query string parameter "url", allowing a...

WS-2019-0235

swagger-ui versions before 2.2.1 are vulnerable to XSS when it fails to encode output in GET requests. The request is meant to respond with Content-Type application/json which does not trigger the vulnerability but if the web server changes the header to text/html it may allow attackers to execut...

WS-2019-0236

swagger-ui versions before 3.0.13 are vulnerable to XSS when it fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript...

WS-2019-0213

restify-swagger-jsdoc versions before 3.2.1 has a path traversal vulnerability when failing to properly sanitize URLs, which may allow attackers to access server files outside the swagger-ui folder by using relative paths...

WS-2019-0171

swagger-ui before 3.18.0 has Reverse Tabnapping vulnerability. using target='blank' in anchor tags, allowing attackers to access window.opener for the original page...

WS-2018-0593

swagger-ui before v3.18.0 is vulnerable to Reverse Tabnabbing. Setting target=\blank\ on anchor tags is unsafe unless used in conjunction with the rel=\noopener\ attribute. A link opened via target blank attribute can make changes to the original page...

WS-2017-0001

"xxxFury-adapter-swagger has a vulnerability that allows arbitrary file reads off the file system. This could be used to retrieve sensitive data, or cause a denial of service by reading /dev/zero."...

WS-2016-0051

"Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets.In versions 2.1.0-M1 and 2.1.0-M2, swagger-ui has a cross site scripting XSS vulnerability in the url query string parameter."...

GHSA-7WW3-XVF5-CXWM ciguard: Web UI is missing HTTP defence-in-depth headers

Summary ciguard's FastAPI Web UI src/ciguard/web/app.py does not set HTTP defence-in-depth headers. OWASP ZAP baseline scan flagged 11 alerts: missing Content-Security-Policy Medium, X-Frame-Options Medium, Sub-Resource-Integrity on /api/docs Medium, COOP / COEP / CORP Low, Permissions-Policy Low...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: osv-scanner, yunikorn-k8shim, gitness, rancher-fleet, temporal-ui-server, vault-env, kubernetes-csi-external-health-monitor, dgraph, kubernetes-csi-external-attacher, litestream, descheduler, swagger, gh, keda, fscrypt, kubernetes-csi-livenessprobe, net-kourier,...

GitLab 15.11 < 18.4.6 / 18.5 < 18.5.4 / 18.6 < 18.6.2 (CVE-2025-12029)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, under certain circumstances, allowed an...

swagger-xss

...

CVE-2026-25141

Orval generates type-safe JS clients TypeScript from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ', double quotes " and so...

CVE-2026-25141

Orval generates type-safe JS clients TypeScript from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ', double quotes " and so...

EUVD-2026-5007

Orval generates type-safe JS clients TypeScript from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ', double quotes " and so...

CVE-2026-25141: Improper Control of Generation of Code

Orval generates type-safe JS clients TypeScript from any valid OpenAPI v3 or Swagger v2 specification. Versions starting with 7.19.0 and prior to 7.21.0 and 8.2.0 have an incomplete fix for CVE-2026-23947. While the jsStringEscape function properly handles single quotes ', double quotes " and so...

CVE-2026-24132

Orval generates type-safe JS clients TypeScript from any valid OpenAPI v3 or Swagger v2 specification. Versions 7.19.0 and below and 8.0.0-rc.0 through 8.0.2 allow untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript into generated mock files via the const keyword on schema...