The vulnerability
Rapid7 researchers identified a serious parameter injection vulnerability in the Swagger Code Generator. Parsers for Swagger documents written in JSON did not properly sanitize input, allowing an attacker to embed executable code in a Swagger JSON file. When a developer used the generator to produce client or server code, the malicious payload would execute in the development environment. The flaw affected NodeJS, Ruby, PHP, Java, and likely other language targets.
Disclosure timeline and maintainer response
Rapid7 privately disclosed the issue in April 2016. According to their disclosure, they received no response from Swagger's maintainers. In June, Rapid7 published full details, a Metasploit module for testing, and a proposed patch for the specification. The public disclosure appeared on the Rapid7 community blog and was reported by Threatpost, ZDNet Zero Day, and Slashdot.
Specification transition
As of January 1, 2016, the Swagger specification had been donated to the Open API Initiative and became the foundation for the OpenAPI Specification. The vulnerability existed in the code generator tooling rather than the specification itself, but the transition period meant maintainership and patch coordination were in flux.