Skip to main content
cve.nowby Sazabi
← npm
npmPackage

yapi-vendor

4 known vulnerabilities (1 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
1.12.0 (Nov 1, 2022): affected by CVE-2025-70058
Newest unaffected release
Every release is affected by at least one advisory
Advisories
4 · 1 high, 1 medium
Weekly downloads
552
Dependents
0
Releases
41 since 1.4.1 (Nov 6, 2018)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 4

  • An issue pertaining to CWE-295: Improper Certificate Validation was discovered in YMFE yapi v1.12.0.

    Affected: through 1.12.0.

    No fix released. The latest release, 1.12.0, is still affected.

    100% of yapi-vendor downloads last week were affected versions (499).

  • CVE-2021-36686Medium 5.4

    Cross Site Scripting (XSS) vulnerability in yapi 1.9.1 allows attackers to execute arbitrary code via the /interface/api edit page.

    Affected: through 1.9.1.

    Fixed in 1.9.2 (released May 29, 2020, 972 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 1.12.0, is not affected.

    48% of yapi-vendor downloads last week were affected versions (241).

  • Weak JSON Web Token (JWT) signing secret generation in YMFE YApi through 1.9.2 allows recreation of other users' JWT tokens.

    Affected: fixed in 1.9.3.

    Fixed in 1.10.1 (released Aug 30, 2021, 182 days after disclosure, the advisory names 1.9.3, which was never published).

    The latest release, 1.12.0, is not affected.

    53% of yapi-vendor downloads last week were affected versions (266).

  • An issue was discovered in YMFE YApi 1.3.23.

    Affected: fixed in 1.3.23.

    Fixed in 1.4.1 (released Nov 6, 2018, 39 days after disclosure, the advisory names 1.3.23, which was never published).

    The latest release, 1.12.0, is not affected.

    0% of yapi-vendor downloads last week were affected versions (0).