# CVE-2021-46708: swagger-ui-dist clickjacking vulnerability

Source: https://junglewise.ai/threats/cve-2021-46708-swagger-ui-dist-clickjacking-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-03-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2021-46708 · Severity: low · CVSS 3.1 · Published 2022-03-12

swagger-ui-dist is a JavaScript library that generates interactive API documentation from OpenAPI specifications. An attacker could trick users into clicking malicious links or buttons by hijacking click actions through a spoofing attack, potentially leading to account compromise or phishing attacks.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2021-46708 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-46708 being exploited in the wild.

**How severe is CVE-2021-46708?** Low severity, with a CVSS score of 3.1, published 12 March 2022.

**Which products and versions are affected?** swagger-ui-dist (npm) SEMVER:introduced=0,fixed=4.1.3.

**Is there a fix for CVE-2021-46708?** Yes. swagger-ui-dist (npm): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-46708 attacked?** It is attacked over the network.

**Am I affected by CVE-2021-46708?** Check whether you run swagger-ui-dist (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- swagger-ui-dist (npm): upgrade to 4.1.3 or later

  ```sh
  npm install swagger-ui-dist@4.1.3
  ```


## Technical details

This vulnerability is a clickjacking attack (CWE-1021) that allows remote attackers to hijack user click actions on swagger-ui-dist pages. The vulnerability affects all versions before 4.1.3 and does not require authentication. An attacker must persuade a victim to visit a malicious website hosting or embedding swagger-ui-dist, where the attacker can intercept and redirect click actions to perform unintended operations. The vulnerability was patched in version 4.1.3.

## Affected products

- Swagger API swagger-ui-dist before 4.1.3

## Identifiers

- CVE-2021-46708
- GHSA-6c9x-mj3g-h47x

## Timeline

- 2022-03-12: disclosed
- 2022-03-12: patched: Version 4.1.3 released

## References

- [https://github.com/swagger-api/swagger-ui](https://github.com/swagger-api/swagger-ui)

## Related threats

- [Swagger UI phishing vector via URL parameter](https://junglewise.ai/threats/swagger-ui-phishing-vector-via-url-parameter-8eeaa776)