GHSA-g662-qq45-ppwmMediumCVSS 5.4

Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users

Published
December 21, 2022
Last Modified
January 30, 2023

🔗 CVE IDs covered (1)

CVE-2022-25929 →

📋 Description

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

🎯 Affected products1

  • npm/smoothie:>= 1.31.0, < 1.36.1

🔗 References (7)