Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users

MEDIUM 5.4CVE-2022-25929 · GHSA-g662-qq45-ppwm · Published 21/12/2022 · updated 17/06/2026

In short

CVE-2022-25929 is a MEDIUM (CVSS 5.4) vulnerability affecting smoothie charts (smoothiecharts), smoothie.
Chance of exploitation in the next 30 days (EPSS): 0.87%, higher than 59.0% of all vulnerabilities.
Fix: update to 1.36.1 or later.

Package	Affected versions	Patched versions
smoothie charts smoothiecharts	`≥ 1.31.0, < 1.36.1`	`1.36.1`
smoothie npm	`≥ 1.31.0, < 1.36.1`	`1.36.1`

Description

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2022-25929 · ADVISORY
joewalnes/smoothie#147 · WEB
joewalnes/smoothie commit 8e0920d · WEB
joewalnes/smoothie · PACKAGE
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369 · WEB
security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368 · WEB
security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

smoothie charts

smoothiecharts

≥ 1.31.0, < 1.36.1

1.36.1

smoothie

npm

≥ 1.31.0, < 1.36.1

1.36.1

Description

NVD description