GHSA-x9p2-fxq6-2m5fMediumCVSS 4.3Disclosed before NVD

Reverse Tabnapping in swagger-ui

Published
June 20, 2019
Last Modified
January 9, 2023

📋 Description

Versions of swagger-ui prior to 3.18.0 are vulnerable to Reverse Tabnapping. The package uses target='_blank' in anchor tags, allowing attackers to access window.opener for the original page. This is commonly used for phishing attacks.

Recommendation

Upgrade to version 3.18.0 or later.

🎯 Affected products1

  • npm/swagger-ui:< 3.18.0

🔗 References (6)