CVSS 3.0
8.8 highCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVE-2017-1000208
A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 77% of CVEs (scores of 2026-10-31)
- CWE
- CWE-502
- Published
- Modified
- Record from
- the NVD, synced
Affected
- swagger:swagger-codegen
- swagger:swagger-parser
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q7pf-qr96-2vq5 | Maven | io.swagger:swagger-codegen | <2.2.2 | 2.2.2 |
| GHSA-q7pf-qr96-2vq5 | Maven | io.swagger:swagger-parser | <1.0.31 | 1.0.31 |