Skip to content
Sign in
5.4 Medium

CVE-2022-25929 The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user…

Description

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

Affected products and versions

Product Affected versions Fixed in
smoothie 1.36 earliest → < 1.36.1 1.36.1
smoothie 1.31 1.31.0 → latest No fix stated
Track this CVE