Previous to v5.19, Swagger-UI depended on DOMPurify 3.1.6, for which a CVE has been reported.
This was apparently fixed here: swagger-api/swagger-ui#10285
The fix should be included in the v5.19 and v5.20 releases of Swagger-UI.
Would be great if you could update the dependency in ring-swagger-ui ! π