~ / search / GHSA-g662-qq45-ppwm

GHSA-g662-qq45-ppwm

Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users

Source: GitHub Advisory Database (reviewed) Moderate CVE-2022-25929

Packages

EcosystemPackageAffectedFixed in
npm smoothie >= 1.31.0, < 1.36.1 1.36.1

Details

As written in the advisory (Markdown source, shown as plain text).

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

References

External links from the advisory. They lead to third-party sites.