{ "@id": "urn:uuid:e31c961d-0a63-452a-8717-a9c9f92122d3", "role": "Document Creator", "author": "https://tuxcare.com", "version": 6, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-04T00:50:56.815414+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:50:00.073591+00:00", "status_notes": "Vulnerability CVE-2016-1000226 does not affect version 2.2.10-tuxcare.2 of swagger-ui. not_affected \u2014 The target swagger-ui version 2.2.10-tuxcare.2 is not affected by CVE-2016-1000226. The XSS vulnerability in the `consumes` and `produces` parameters was fixed upstream in version 2.2.1 (commit 11f1263a by Anna Bodnia), which is before the current version. The fix added proper HTML sanitization and escaping to these parameters in the Handlebars templates, preventing script injection. This upstr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-1000226" }, "impact_statement": "not_affected \u2014 The target swagger-ui version 2.2.10-tuxcare.2 is not affected by CVE-2016-1000226. The XSS vulnerability in the `consumes` and `produces` parameters was fixed upstream in version 2.2.1 (commit 11f1263a by Anna Bodnia), which is before the current version. The fix added proper HTML sanitization and escaping to these parameters in the Handlebars templates, preventing script injection. This upstr..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-10-30T20:14:34.797503+00:00", "status_notes": "Vulnerability CVE-2016-1000229 affects version 2.2.10-tuxcare.2 of swagger-ui.", "vulnerability": { "name": "CVE-2016-1000229" }, "action_statement": "Vulnerability CVE-2016-1000229 affects version 2.2.10-tuxcare.2 of swagger-ui." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:50:00.073591+00:00", "status_notes": "Vulnerability CVE-2016-1000233 does not affect version 2.2.10-tuxcare.2 of swagger-ui. not_affected \u2014 CVE-2016-1000233 (XSS vulnerability) is NOT present in swagger-ui 2.2.10. The vulnerability was fixed in upstream version 2.2.1 (August 2016) by adding comprehensive HTML/JavaScript sanitization to prevent malicious content in Swagger specifications from executing in the browser. The fix was authored by Anna Bodnia and shipped in the upstream release that TuxCare later onboarded. Target version...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-1000233" }, "impact_statement": "not_affected \u2014 CVE-2016-1000233 (XSS vulnerability) is NOT present in swagger-ui 2.2.10. The vulnerability was fixed in upstream version 2.2.1 (August 2016) by adding comprehensive HTML/JavaScript sanitization to prevent malicious content in Swagger specifications from executing in the browser. The fix was authored by Anna Bodnia and shipped in the upstream release that TuxCare later onboarded. Target version..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:50:56.815414+00:00", "status_notes": "Vulnerability CVE-2016-5682 does not affect version 2.2.10-tuxcare.2 of swagger-ui. not_affected \u2014 CVE-2016-5682 describes an XSS vulnerability in swagger-ui where malicious JavaScript can be injected through property key names in the definitions.properties structure of JSON documents. The target version 2.2.10 already contains the upstream fix (commit 11f1263a) that was released in v2.2.1. The fix introduces a 'sanitize' Handlebars helper using the sanitize-html library to strip dangerous H...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2016-5682" }, "impact_statement": "not_affected \u2014 CVE-2016-5682 describes an XSS vulnerability in swagger-ui where malicious JavaScript can be injected through property key names in the definitions.properties structure of JSON documents. The target version 2.2.10 already contains the upstream fix (commit 11f1263a) that was released in v2.2.1. The fix introduces a 'sanitize' Handlebars helper using the sanitize-html library to strip dangerous H..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2018-25031 is fixed in version 2.2.10-tuxcare.2 of swagger-ui.", "vulnerability": { "name": "CVE-2018-25031" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-17495 is fixed in version 2.2.10-tuxcare.2 of swagger-ui.", "vulnerability": { "name": "CVE-2019-17495" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:50:00.073591+00:00", "status_notes": "Vulnerability GHSA-22q9-hqm5-mhmc does not affect version 2.2.10-tuxcare.2 of swagger-ui. not_affected \u2014 The target swagger-ui version 2.2.10-tuxcare.2 is NOT affected by GHSA-22q9-hqm5-mhmc. The XSS vulnerability affecting versions prior to 2.2.1 was fixed by upstream developers in v2.2.1 (commits 50c713a2, 11f1263a, a1aea70f from Jan-Aug 2016). The fix changed Handlebars templates from unescaped output {{{this}}} to escaped output {{this}}, and added sanitize/escape helpers. TuxCare's onboarding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-22q9-hqm5-mhmc" }, "impact_statement": "not_affected \u2014 The target swagger-ui version 2.2.10-tuxcare.2 is NOT affected by GHSA-22q9-hqm5-mhmc. The XSS vulnerability affecting versions prior to 2.2.1 was fixed by upstream developers in v2.2.1 (commits 50c713a2, 11f1263a, a1aea70f from Jan-Aug 2016). The fix changed Handlebars templates from unescaped output {{{this}}} to escaped output {{this}}, and added sanitize/escape helpers. TuxCare's onboarding..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-388g-jwpg-x6j4 is fixed in version 2.2.10-tuxcare.2 of swagger-ui.", "vulnerability": { "name": "GHSA-388g-jwpg-x6j4" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-4f9m-pxwh-68hg is fixed in version 2.2.10-tuxcare.2 of swagger-ui.", "vulnerability": { "name": "GHSA-4f9m-pxwh-68hg" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-10-30T20:14:14.958440+00:00", "status_notes": "Vulnerability GHSA-g336-c7wv-8hp3 affects version 2.2.10-tuxcare.2 of swagger-ui.", "vulnerability": { "name": "GHSA-g336-c7wv-8hp3" }, "action_statement": "Vulnerability GHSA-g336-c7wv-8hp3 affects version 2.2.10-tuxcare.2 of swagger-ui." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-qrmm-w75w-3wpx is fixed in version 2.2.10-tuxcare.2 of swagger-ui.", "vulnerability": { "name": "GHSA-qrmm-w75w-3wpx" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:50:00.073591+00:00", "status_notes": "Vulnerability GHSA-vp93-gcx5-4w52 does not affect version 2.2.10-tuxcare.2 of swagger-ui. not_affected \u2014 The target swagger-ui version 2.2.10 is not affected by GHSA-vp93-gcx5-4w52 (XSS via unsanitized JSON schema descriptions). The vulnerability affected versions prior to 2.2.1. The target includes upstream fixes from v2.2.1 (Aug 2016, commit a1aea70f) and v2.2.3 (Sep 2016, commit f87eaaa8) that sanitize all description fields before rendering, stripping script tags and dangerous attributes. All ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-vp93-gcx5-4w52" }, "impact_statement": "not_affected \u2014 The target swagger-ui version 2.2.10 is not affected by GHSA-vp93-gcx5-4w52 (XSS via unsanitized JSON schema descriptions). The vulnerability affected versions prior to 2.2.1. The target includes upstream fixes from v2.2.1 (Aug 2016, commit a1aea70f) and v2.2.3 (Sep 2016, commit f87eaaa8) that sanitize all description fields before rendering, stripping script tags and dangerous attributes. All ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-11-04T00:50:00.073591+00:00", "status_notes": "Vulnerability GHSA-w992-2gmj-9xxj does not affect version 2.2.10-tuxcare.2 of swagger-ui. not_affected \u2014 The target repository (swagger-ui v2.2.10-tuxcare.2) is NOT AFFECTED by GHSA-w992-2gmj-9xxj. The XSS vulnerability in info.description was fixed in upstream v2.2.1 by Anna Bodnia (commit a1aea70f). The fix uses the 'sanitize' Handlebars helper with the sanitize-html library to sanitize HTML before rendering. This upstream fix was already present when TuxCare began maintaining this version (firs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-w992-2gmj-9xxj" }, "impact_statement": "not_affected \u2014 The target repository (swagger-ui v2.2.10-tuxcare.2) is NOT AFFECTED by GHSA-w992-2gmj-9xxj. The XSS vulnerability in info.description was fixed in upstream v2.2.1 by Anna Bodnia (commit a1aea70f). The fix uses the 'sanitize' Handlebars helper with the sanitize-html library to sanitize HTML before rendering. This upstream fix was already present when TuxCare began maintaining this version (firs..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/swagger-ui@2.2.10-tuxcare.2", "identifiers": { "purl": "pkg:npm/swagger-ui@2.2.10-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-x9p2-fxq6-2m5f is fixed in version 2.2.10-tuxcare.2 of swagger-ui.", "vulnerability": { "name": "GHSA-x9p2-fxq6-2m5f" } } ] }