CVE-2017-1000208
HIGHSwagger-Parser <=1.0.30 - RCE
Title source: llmDescription
A vulnerability in Swagger-Parser's (version <= 1.0.30) yaml parsing functionality results in arbitrary code being executed when a maliciously crafted yaml Open-API specification is parsed. This in particular, affects the 'generate' and 'validate' command in swagger-codegen (<= 2.2.2) and can lead to arbitrary code being executed when these commands are used on a well-crafted yaml specification.
Exploits (2)
nomisec
WORKING POC
by andikahilmy · poc
https://github.com/andikahilmy/CVE-2017-1000208-swagger-parser-vulnerable
nomisec
by dawetmaster · poc
https://github.com/dawetmaster/CVE-2017-1000208-swagger-parser-vulnerable
Scores
CVSS v3
8.8
EPSS
0.0046
EPSS Percentile
64.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Classification
CWE
CWE-502
Status
draft
Affected Products (4)
swagger/swagger-codegen
< 2.2.2
swagger/swagger-parser
< 1.0.30
io.swagger/swagger-codegen
< 2.2.2Maven
io.swagger/swagger-parser
< 1.0.31Maven
Timeline
Published
Nov 17, 2017
Tracked Since
Feb 18, 2026