Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-r28p-re5d-uya7
Vulnerability ID VCID-r28p-re5d-uya7
Aliases CVE-2016-1000233
GHSA-mrx7-8hxf-f853
GMS-2020-785
Summary XSS via Content-type header By using a malicious server which returns script as the value of the Content-Type header, it is possible to execute arbitrary code using the demonstration capabilities of Swagger-UI.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
System Score Found at
cvssv3 7.3 https://github.com/nodejs/security-wg/blob/main/vuln/npm/131.json
generic_textual HIGH https://github.com/swagger-api/swagger-ui
generic_textual HIGH https://github.com/swagger-api/swagger-ui/commit/331d2be070d89162aa3174a8773ae4a0093f78bc
cvssv3 7.3 https://github.com/swagger-api/swagger-ui/issues/1863
generic_textual HIGH https://github.com/swagger-api/swagger-ui/issues/1863
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2016-1000233
generic_textual HIGH https://www.npmjs.com/advisories/131
Reference id Reference type URL
https://github.com/swagger-api/swagger-ui
https://github.com/swagger-api/swagger-ui/commit/331d2be070d89162aa3174a8773ae4a0093f78bc
https://github.com/swagger-api/swagger-ui/issues/1863
https://www.npmjs.com/advisories/131
131 https://github.com/nodejs/security-wg/blob/main/vuln/npm/131.json
CVE-2016-1000233 https://nvd.nist.gov/vuln/detail/CVE-2016-1000233
GHSA-mrx7-8hxf-f853 https://github.com/advisories/GHSA-mrx7-8hxf-f853
No exploits are available.

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-06-02T03:45:03.262424+00:00 Npm Importer Import https://github.com/nodejs/security-wg/blob/main/vuln/npm/131.json 38.6.0