CVE-2016-1000233

Name of the Vulnerable Software and Affected Versions: swagger-ui versions prior to 2.2.1

Description: The issue exists due to the automatic execution of external Javascript loaded via the url query string parameter when a Content-Type: application/javascript header is included. An attacker can create a malicious script and craft a URL that includes the location to their server/script in the url query string parameter, allowing the execution of the malicious script when the link is viewed.

Recommendations: Update to version 2.2.1 or later.