Lithium vulnerable to Cross Site Scripting in provided Swagger-UI
Impact
A XSS vulnerability in the provided (outdated) Swagger-UI is exploitable in applications using lithium with Swagger-UI enabled. This allows an attacker gain Remote Code Execution (RCE) and potentially exfiltrate secrets in the context of this swagger session.
Patches
The used swagger-ui was updated by switching to the latest version of dropwizard-swagger in 8b9b406d608fe482ec0e7adf8705834bca92d7df
Workarounds
The risk of injected external content can be reduced by setting up a Content-Security-Policy.
References
Credits
We thank Mohit Kumar for reporting this vulnerability!
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | com.wire.bots:lithium | all versions | no fix |
| Java / Kotlin (Maven) | com.wire:lithium | < 3.4.2 | 3.4.2 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N- Weakness (CWE)
CWE-79- Platform
- Java / Kotlin (Maven)
- Package
com.wire.bots:lithium, com.wire:lithium- Disclosed
- 30.09.2022
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-f36p-42jv-8rh2 - CC BY 4.0
Vulnerability history: com.wire.bots:lithium
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.