CVE-2022-25929
1 advisory.
npm/smoothie CVE-2022-25929: medium 5.4, EPSS 0.87%
Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users
Action: Upgrade smoothie to 1.36.1 or later.
npm i smoothie@1.36.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.31.0 | 1.36.1 | - |
Fixed versions
| 1.36.1 |
Sources
- osv: GHSA-g662-qq45-ppwm
- https://nvd.nist.gov/vuln/detail/CVE-2022-25929
- https://github.com/joewalnes/smoothie/pull/147
- https://github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98
- https://github.com/joewalnes/smoothie
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369
- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368
- https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364
CVE-2022-25929 · published · modified · JSON