How severe is GHSA-f36p-42jv-8rh2?

GHSA-f36p-42jv-8rh2 has a CVSS score of 8.1/10, rated HIGH. Immediate patching is strongly recommended.

Which packages are affected by GHSA-f36p-42jv-8rh2?

GHSA-f36p-42jv-8rh2 affects the following packages: com.wire:lithium (Maven), com.wire.bots:lithium (Maven). Ecosystems affected: Maven.

How do I fix GHSA-f36p-42jv-8rh2?

Update com.wire:lithium to 3.4.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-f36p-42jv-8rh2 is resolved across your whole dependency graph.

How do I detect GHSA-f36p-42jv-8rh2 in my Maven dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.wire:lithium, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-f36p-42jv-8rh2 if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is GHSA-f36p-42jv-8rh2 actively exploited in the wild?

No public exploit code has been indexed for GHSA-f36p-42jv-8rh2 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-f36p-42jv-8rh2 published, and has it been updated?

GHSA-f36p-42jv-8rh2 was published on September 30, 2022 and was last updated on November 28, 2024. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

☕

☕ Maven

Not in CISA KEV

HIGH severity

Lithium vulnerable to Cross Site Scripting in provided Swagger-UIGHSA-f36p-42jv-8rh2

HIGHFix: wireapp/lithium@8b9b406

GHSA-f36p-42jv-8rh2 is a high-severity (CVSS 8.1) remote code execution vulnerability in com.wire:lithium. A fix is available for com.wire:lithium — see the affected versions and patch details below.

Published

Sep 30, 2022

Updated

Nov 28, 2024

Affected

2 pkgs

Patched

1 / 2

Exploits

None indexed

Exploitation data as of Nov 28, 2024 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

2 pkgs affected

☕com.wire:lithium☕com.wire.bots:lithium

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Maven packages — download data is not available via public APIs for these ecosystems.

Description

Impact

A XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagger session.

Patches

The used swagger-ui was updated by switching to the latest version of dropwizard-swagger in 8b9b406d608fe482ec0e7adf8705834bca92d7df

Workarounds

The risk of injected external content can be reduced by setting up a Content-Security-Policy.

References

https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/

Credits

We thank Mohit Kumar for reporting this vulnerability!

Affected Packages

2 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
☕Maven	`com.wire:lithium`	all versions	3.4.2`com.wire:lithium:3.4.2`
☕Maven	`com.wire.bots:lithium`	all versions	No fix

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for com.wire:lithium, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update com.wire:lithium to 3.4.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-f36p-42jv-8rh2 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact A XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagger session. ### Patches The used swagger-ui was updated by switching to the latest version of dropwizard-swagger in 8b9b406d608fe482ec0e7adf8705834bca92d7df ### Workarounds The risk of injected external content can be reduced by setting up a [Content-Security-Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Se

O3 Security · Impact-Aware SCA

Is GHSA-f36p-42jv-8rh2 in your dependencies?

Find it across Maven, including transitive dependencies.

Scan my dependencies How O3 SCA works