NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
☕
☕ Maven📦 npm
Not in CISA KEV
CRITICAL severity

Cross-site scripting in Swagger-UIGHSA-c427-hjc3-wrfw

CRITICALFix: springfox/springfox@26f72f0

GHSA-c427-hjc3-wrfw is a critical-severity (CVSS 9.8) Cross-Site Request Forgery (CSRF) vulnerability in org.webjars:swagger-ui. 1 public exploit or proof-of-concept reference is indexed, so weaponization risk is real. A fix is available for org.webjars:swagger-ui — see the affected versions and patch details below.

Also known asCVE-2019-17495
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
1 known
Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
5.7%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs93th percentile — riskier than 93% of all scored CVEsHighest risk
3.78%6.98%10.2%13.4%11.6%5.7%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected
☕org.webjars:swagger-ui☕org.webjars.npm:swagger-ui☕io.springfox:springfox-swagger-ui📦swagger-ui

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
☕Mavenorg.webjars:swagger-uiall versions3.23.11org.webjars:swagger-ui:3.23.11
☕Mavenorg.webjars.npm:swagger-uiall versions3.23.11org.webjars.npm:swagger-ui:3.23.11
☕Mavenio.springfox:springfox-swagger-uiall versions2.10.0io.springfox:springfox-swagger-ui:2.10.0
📦npmswagger-uiall versions3.23.11npm install swagger-ui@3.23.11

Affected Products

6 products · 17 configurations
Application
banking apisoracle
≥ 18.1 && ≤ 18.3
4 versions
19.119.220.121.1
Application
banking digital experienceoracle
≥ 18.1 && ≤ 18.3
4 versions
19.119.220.121.1
Application
banking platformoracle
≥ 2.4.0 && ≤ 2.10.0
range
Application
primavera gatewayoracle
≥ 17.12.0 && ≤ 17.12.8
range
Application
utilities frameworkoracle
3 versions
4.3.0.6.04.4.0.0.04.4.0.2.0
Application
swagger uismartbear
< 3.23.11
range
Exploits & PoCs
1

Research use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI bef…

github.comNVDJun 2021

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for org.webjars:swagger-ui, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update org.webjars:swagger-ui to 3.23.11 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-c427-hjc3-wrfw is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) technique to perform CSS-based input field value exfiltration, such as exfiltration of a CSRF token value. In other words, this product intentionally allows the embedding of untrusted JSON data from remote servers, but it was not previously known that <style>@import within the JSON data was a functional attack method.
O3 Security · Impact-Aware SCA

Is GHSA-c427-hjc3-wrfw in your dependencies?

Find it across Maven, npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
Cross-site scripting in Swagger-UI (Critical 9.8)