{"action":"Upgrade smoothie to 1.36.1 or later.","affected":[{"fixed":"1.36.1","introduced":"1.31.0"}],"component":"smoothie","cve_ids":["CVE-2022-25929"],"ecosystem":"npm","epss":0.00868,"exploited":false,"fixed_versions":["1.36.1"],"ghsa_id":"GHSA-g662-qq45-ppwm","id":"tcs_01M5KFQAF139PGB1A3GKNRYN00","modified_at":"2023-11-08T04:08:52.442702Z","published_at":"2022-12-21T06:30:29Z","references":["https://osv.dev/vulnerability/GHSA-g662-qq45-ppwm","https://nvd.nist.gov/vuln/detail/CVE-2022-25929","https://github.com/joewalnes/smoothie/pull/147","https://github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98","https://github.com/joewalnes/smoothie","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368","https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-g662-qq45-ppwm","url":"https://osv.dev/vulnerability/GHSA-g662-qq45-ppwm"}],"summary":"Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users"}