# CVE-2021-36686: YApi stored cross-site scripting in interface remarks

Source: https://junglewise.ai/threats/cve-2021-36686-yapi-stored-cross-site-scripting-in-interface-remarks  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-01-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-36686 · Severity: low · CVSS 3.1 · Published 2023-01-26

YApi is an open-source API documentation and management platform. A stored XSS vulnerability in the interface remarks field allows users to inject malicious JavaScript code that executes when other team members view interface documentation. An attacker can use this to steal session tokens, credentials, or perform unauthorized actions on behalf of victims viewing the affected interface.

Technologies: [yapi-vendor (npm)](https://junglewise.ai/threats/technologies/yapi-vendor), [Ymfe Yapi](https://junglewise.ai/threats/technologies/yapi). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Ymfe](https://junglewise.ai/threats/vendors/ymfe).

## Quick answers

**Is CVE-2021-36686 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-36686 being exploited in the wild.

**How severe is CVE-2021-36686?** Low severity, with a CVSS score of 3.1, published 26 January 2023.

**Which products and versions are affected?** yapi-vendor (npm) SEMVER:introduced=0,last_affected=1.9.1; Ymfe Yapi up to 1.9.1.

**Is there a fix for CVE-2021-36686?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-36686 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-36686?** Check whether you run yapi-vendor (npm) or Ymfe Yapi at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (CWE-79) vulnerability in the yapi-vendor npm package affecting version 1.9.1 and earlier. The vulnerability exists in the interface edit page's remarks field, which fails to properly sanitize user input before storing and rendering HTML content. Attackers with access to create or edit interfaces can inject malicious SVG or HTML payloads (e.g., <svg onload=alert()> or <video onerror=alert()>) that are stored in the database. When any project member views the interface edit page, the payload is executed in their browser within the context of the application domain. This requires authentication to access the interface editor but affects all users subsequently viewing the compromised interface. No patch information is currently available in the advisory.

## Affected products

- YMFE yapi-vendor up to 1.9.1

## Identifiers

- CVE-2021-36686
- GHSA-4jqw-vfmj-9rmh

## Timeline

- 2021-05-08: disclosed: Issue #2190 opened reporting stored XSS in remarks
- 2021-07-09: disclosed: Issue #2240 opened confirming stored XSS via SVG payload in remarks
- 2023-01-26: advisory: CVE-2021-36686 published and GHSA-4jqw-vfmj-9rmh advisory released

## References

- [https://github.com/YMFE/yapi/issues/2190](https://github.com/YMFE/yapi/issues/2190)
- [https://github.com/YMFE/yapi/issues/2240](https://github.com/YMFE/yapi/issues/2240)
- [https://github.com/YMFE/yapi](https://github.com/YMFE/yapi)

## Related threats

- [An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in YMFE yapi v1.12.0.](https://junglewise.ai/threats/cve-2025-70060-an-issue-pertaining-to-cwe-79-improper-neutralization-of-input)
- [YMFE yapi TLS/SSL certificate validation bypass](https://junglewise.ai/threats/cve-2025-70058-ymfe-yapi-tls-ssl-certificate-validation-bypass)
- [YMFE YApi weak JWT secret generation in yapi-vendor](https://junglewise.ai/threats/cve-2021-27884-ymfe-yapi-weak-jwt-secret-generation-in-yapi-vendor)
- [YMFE YApi stored cross-site scripting in project name](https://junglewise.ai/threats/cve-2018-17574-ymfe-yapi-stored-cross-site-scripting-in-project-name)