CVE-2022-25929

Cross-site Scripting (XSS)

Medium5.4EPSS 0.87%

Published: 21 Dec 2022
Updated: 16 Apr 2025
Reserved: 24 Feb 2022
Assigned by: snyk

Description

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

Scores

CVSS scores of CVE-2022-25929, by who scored it
Scored by	CVSS	Score	Vector
snykCNA (assigner)	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P
NVDNVD · Modified	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.87% · top 41% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

Cross-site Scripting (XSS)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (opens in a new tab)All about CWE-79 and its CVEs

Affected products

smoothie
- affected 1.31.0 – < unspecified
- affected unspecified – < 1.36.1

Affected packages

From reviewed advisories of the GitHub Advisory Database.

npmsmoothieGHSA-g662-qq45-ppwm (opens in a new tab)

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-25929](https://trackcve.app/badge/CVE-2022-25929.svg)](https://trackcve.app/cve/CVE-2022-25929)

Record last updated 16 Apr 2025, 18:32 UTC.