# CVE-2016-1000226: Swagger UI cross-site scripting in swagger JSON parameters

Source: https://junglewise.ai/threats/cve-2016-1000226-swagger-ui-cross-site-scripting-in-swagger-json-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2016-1000226 · Severity: info · Published 2020-09-01

Swagger UI is a web-based tool used to display and test API documentation. The vulnerability allows attackers to inject malicious JavaScript code through the "consumes" and "produces" fields in API specification documents. An attacker can craft a link pointing to a malicious API specification file, and if a user visits that link, the injected code will execute in their browser, potentially compromising their session or stealing sensitive data.

Technologies: [swagger-ui (npm)](https://junglewise.ai/threats/technologies/swagger-ui). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2016-1000226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2016-1000226 being exploited in the wild.

**How severe is CVE-2016-1000226?** Informational severity, published 1 September 2020.

**Which products and versions are affected?** swagger-ui (npm) SEMVER:introduced=0,fixed=2.2.1.

**Is there a fix for CVE-2016-1000226?** Yes. swagger-ui (npm): upgrade to 2.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2016-1000226 attacked?** It is attacked over the network.

**Am I affected by CVE-2016-1000226?** Check whether you run swagger-ui (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- swagger-ui (npm): upgrade to 2.2.1 or later

  ```sh
  npm install swagger-ui@2.2.1
  ```


## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in swagger-ui versions prior to 2.2.1. The root cause is that user-supplied data in the "consumes" and "produces" fields of Swagger JSON documents are rendered without proper HTML entity encoding. An attacker can supply a malicious Swagger JSON file via the "url" query parameter, causing swagger-ui to load and parse it. When the JSON is displayed in the UI, any JavaScript payloads embedded in these fields will execute with the privileges of the authenticated user. No special authentication is required; an attacker only needs to convince a user to click a crafted link. The fix available in version 2.2.1 and later properly escapes these fields to prevent script injection.

## Affected products

- Swagger swagger-ui prior to 2.2.1

## Identifiers

- CVE-2016-1000226
- GHSA-7f59-x49p-v8mq

## Timeline

- 2016-01-13: disclosed: Issue opened on GitHub
- 2016: patched: Fixed in version 2.2.1
- 2020-09-01: advisory: Published in GHSA

## References

- [https://github.com/swagger-api/swagger-ui/issues/1866](https://github.com/swagger-api/swagger-ui/issues/1866)

## Related threats

- [swagger-ui cross-site scripting in key names](https://junglewise.ai/threats/cve-2016-1000229-swagger-ui-cross-site-scripting-in-key-names)
- [Swagger UI spoofing attack via URL parameter](https://junglewise.ai/threats/cve-2018-25031-swagger-ui-spoofing-attack-via-url-parameter)
- [Swagger UI phishing vector via URL parameter](https://junglewise.ai/threats/swagger-ui-phishing-vector-via-url-parameter-8eeaa776)
- [Swagger UI Cross-Site Scripting in apiInfo.description](https://junglewise.ai/threats/swagger-ui-cross-site-scripting-in-apiinfo-description-6b3f2dbe)
- [Swagger Swagger UI Cross-Site Scripting in API response rendering](https://junglewise.ai/threats/swagger-swagger-ui-cross-site-scripting-in-api-response-rendering-be1bf724)