AIKIDO-2025-10443

TL;DR

Affected versions of this package are vulnerable to Cross-Site Scripting (XSS) due to improper sanitization of the version parameter in both redoc_dashboard and swagger_dashboard functions. These functions dynamically construct an openapi_url by embedding the user-supplied version value into the response without proper escaping, allowing an attacker to inject malicious JavaScript code. If an attacker crafts a malicious version parameter containing script payloads (e.g.,?version='><script>alert(1)</script>), the payload could execute in the victim's browser when the documentation is rendered.