CVE-2022-25929

Cross-site Scripting (XSS)

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

Affected

smoothie

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS

0.84% chance of exploitation in the next 30 days, 57th percentile

Published

2022-12-21

Updated

2025-04-16

Proof-of-concept exploits (2)

• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369
• https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364

Security advisories

• joewalnes/smoothie/pull/147
• advisories/GHSA-g662-qq45-ppwm

References

• CVE Record
• NVD entry