# Swagger UI

## Version

On Browser console:

```javascript
JSON.stringify(versions['swaggerUi']['version'])
```

![](https://3928478158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhjMjdRXwO33Lfo7uCpl6%2Fuploads%2Fgit-blob-b76b3eb63ccf4da647e1b7f959a5ccd4a043c4c2%2Fswaggerui-version.png?alt=media)

## Documentaion example files

### api.json

```json
{
  "swagger": "2.0",
  "info": {
    "title": "Example json.spec",
    "description": "Description Text"
  },
  "paths": {
    "/accounts": {
      "get": {
        "tags": ["accounts"],
        "summary": "Finds all accounts",
        "operationId": "findAccounts",
        "responses": {
          "200": {
            "description": "No response was specified"
          }
        }
      }
    }
  }
}
```

![](https://3928478158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhjMjdRXwO33Lfo7uCpl6%2Fuploads%2Fgit-blob-ff4f09c20f5f84243a1c4065c31dc6073a9e5731%2Fswagger-json.png?alt=media)

### api.yaml

```yaml
swagger: '2.0'
info:
  title: Example yaml.spec
  description: |
    Description Text
paths:
  /accounts:
    get:
      responses:
        '200':
          description: No response was specified
      tags:
        - accounts
      operationId: findAccounts
      summary: Finds all accounts
```

![](https://3928478158-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FhjMjdRXwO33Lfo7uCpl6%2Fuploads%2Fgit-blob-36c619bb589b4529daee3d540bcac87ab15ef52a%2Fswagger-yaml.png?alt=media)

## DOM XSS

_Swagger 3.14.1 - 3.38.0 with vulnerable DOMPurify version_

*   DOM Mutation XSS with namespace confusion in `Description` field

    ```html
    <math><mtext><option><FAKEFAKE><option></option><mglyph><svg><mtext><textarea><a title=\"</textarea><img src='#' onerror='alert(window.origin)'>\">
    ```
