CVE-2022-25929

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	smoothie	>= 1.31.0, < unspecified; >= unspecified, < 1.36.1

References

https://github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98Patch, Third Party Advisory
https://github.com/joewalnes/smoothie/pull/147Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368Exploit
https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364Exploit, Third Party Advisory
https://github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98Patch, Third Party Advisory
https://github.com/joewalnes/smoothie/pull/147Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369Exploit, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368Exploit
https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364Exploit, Third Party Advisory

Timeline

Published: Dec 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-25937.2The Better Search Replace WordPress plugin before 1.4.1 does not properly sanitise and escape table data before inserting it into a SQL quer CVE-2022-259317.5All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being emplo CVE-2022-259329.8The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An a CVE-2022-259367.5Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.CVE-2022-259376.5Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root di CVE-2022-25948.8The Advanced Custom Fields WordPress plugin before 5.12.3, Advanced Custom Fields Pro WordPress plugin before 5.12.3 allows unauthenticated CVE-2022-259407.5All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control ch CVE-2022-259427.8An out-of-bounds read vulnerability exists in the gif2h5 functionality of HDF5 Group libhdf5 1.10.4. A specially-crafted GIF file can lead t CVE-2022-259437.8The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the serv CVE-2022-259466.5On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configur CVE-2022-259485.3The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in l CVE-2022-259497.8The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading