CVE-2022-25929

Cross-site Scripting (XSS)

Medium · published December 21, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
CVSS v4.0
Not supplied
EPSS
0.00868 · 58.3th percentile
Published
2022-12-21T23:14Z
EPSS history
Timeline
  • 21 DEC 23:14Z
    Cross-site Scripting (XSS)
    cvelistv5