Vulnerability DatabaseCVE-2016-1000233

CVE-2016-1000233
JavaScript vulnerability analysis and mitigation

Overview

Swagger-UI versions prior to 2.2.1 are vulnerable to cross-site scripting (XSS). The vulnerability was discovered in January 2016 and assigned CVE-2016-1000233. The issue affects the swagger-ui npm package and its implementation of response header handling in the curl command generation feature (GitHub Advisory).

Technical details

The vulnerability exists because swagger-ui automatically executes external JavaScript that is loaded via the URL query string parameter when a Content-Type: application/javascript header is included. The core issue lies in the lack of proper escaping of response headers when generating the curl command, which allows for potential script injection (GitHub Issue).

Impact

An attacker can create a server that replies with a malicious script and the proper content-type, and then craft a swagger-ui URL that includes the location to their server/script in the URL query string parameter. When a user views such a link, the attacker's malicious script would execute in the context of the user's browser (GitHub Advisory).

Mitigation and workarounds

The recommended mitigation is to update to Swagger-UI version 2.2.1 or later, which includes a fix for this vulnerability. The fix involves properly escaping the curl command output using _.escape() function (GitHub Commit).

Additional resources


SourceThis report was generated using AI

Related JavaScript vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-71319CRITICAL9.6
  • JavaScript logoJavaScript
  • @nuxt/devtools
NoYesAug 05, 2026
CVE-2026-70611MEDIUM6.9
  • JavaScript logoJavaScript
  • electron
NoYesAug 05, 2026
CVE-2026-70609MEDIUM5.7
  • JavaScript logoJavaScript
  • electron
NoYesAug 05, 2026
CVE-2026-70612MEDIUM5.4
  • JavaScript logoJavaScript
  • electron
NoYesAug 05, 2026
CVE-2026-70610MEDIUM5.4
  • JavaScript logoJavaScript
  • electron
NoYesAug 05, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management