# Swagger UI phishing vector via URL parameter

Source: https://junglewise.ai/threats/swagger-ui-phishing-vector-via-url-parameter-8eeaa776  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-12-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · CVSS 6.5 · Published 2021-12-09

Swagger UI is a library for displaying API documentation. The tool supports loading remote API definitions via a URL parameter, which can be abused in phishing attacks. An attacker can trick users into clicking a link to a legitimate organization's Swagger UI instance (e.g., example.com) but with a malicious URL parameter pointing to a fake API, causing users to unknowingly submit credentials or sensitive data to the attacker's server.

Technologies: [swagger-ui (npm)](https://junglewise.ai/threats/technologies/swagger-ui). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, with a CVSS score of 6.5, published 9 December 2021.

**Which products and versions are affected?** swagger-ui (npm) SEMVER:introduced=0,fixed=4.1.3; swagger-ui-dist (npm) SEMVER:introduced=0,fixed=4.1.3; swagger-ui-react (npm) SEMVER:introduced=0,fixed=4.1.3; Swashbuckle.AspNetCore.SwaggerUI (NuGet) ECOSYSTEM:introduced=0,fixed=6.3.0.

**Is there a fix for This vulnerability?** Yes. swagger-ui (npm): upgrade to 4.1.3 or later; swagger-ui-dist (npm): upgrade to 4.1.3 or later; swagger-ui-react (npm): upgrade to 4.1.3 or later; Swashbuckle.AspNetCore.SwaggerUI (NuGet): upgrade to 6.3.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run swagger-ui (npm), swagger-ui-dist (npm), swagger-ui-react (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- swagger-ui (npm): upgrade to 4.1.3 or later

  ```sh
  npm install swagger-ui@4.1.3
  ```

- swagger-ui-dist (npm): upgrade to 4.1.3 or later

  ```sh
  npm install swagger-ui-dist@4.1.3
  ```

- swagger-ui-react (npm): upgrade to 4.1.3 or later

  ```sh
  npm install swagger-ui-react@4.1.3
  ```

- Swashbuckle.AspNetCore.SwaggerUI (NuGet): upgrade to 6.3.0 or later

  ```sh
  dotnet add package Swashbuckle.AspNetCore.SwaggerUI --version 6.3.0
  ```


## Technical details

Swagger UI versions prior to 4.1.3 allow the ?url query parameter to load remote OpenAPI definitions without restriction. The vulnerability is a server-side request forgery (SSRF) and phishing attack vector where an attacker crafts a URL like https://example.com/api-docs?url=https://evildomain/fakeapi.yaml. When a user clicks this link and uses the "Try-it-out" feature to test APIs, requests are sent to the attacker's server. The attack requires user interaction (clicking the malicious link and submitting data) and cannot be exploited non-interactively for code injection or XSS. The fix, released in version 4.1.3, disables the ?url parameter by default; administrators can re-enable it if needed.

## Affected products

- Swagger Swagger UI < 4.1.3
- Swagger Swagger UI Dist < 4.1.3
- Swagger Swagger UI React < 4.1.3
- Swashbuckle Swashbuckle.AspNetCore.SwaggerUI versions with vulnerable Swagger UI

## Timeline

- 2021-12-09: disclosed: Advisory published
- 2021-12: patched: Version 4.1.3 released with query parameters disabled by default

## References

- [https://github.com/swagger-api/swagger-ui/security/advisories/GHSA-qrmm-w75w-3wpx](https://github.com/swagger-api/swagger-ui/security/advisories/GHSA-qrmm-w75w-3wpx)
- [https://github.com/swagger-api/swagger-ui/issues/4872](https://github.com/swagger-api/swagger-ui/issues/4872)

## Related threats

- [swagger-ui cross-site scripting in key names](https://junglewise.ai/threats/cve-2016-1000229-swagger-ui-cross-site-scripting-in-key-names)
- [swagger-ui-dist clickjacking vulnerability](https://junglewise.ai/threats/cve-2021-46708-swagger-ui-dist-clickjacking-vulnerability)
- [Swagger UI spoofing attack via URL parameter](https://junglewise.ai/threats/cve-2018-25031-swagger-ui-spoofing-attack-via-url-parameter)
- [Swagger UI Cross-Site Scripting in apiInfo.description](https://junglewise.ai/threats/swagger-ui-cross-site-scripting-in-apiinfo-description-6b3f2dbe)
- [Swagger Swagger UI Cross-Site Scripting in API response rendering](https://junglewise.ai/threats/swagger-swagger-ui-cross-site-scripting-in-api-response-rendering-be1bf724)