CVE-2022-25929

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

• CWE-79
• CWE-79

• https://github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98Patch, Third Party Advisory
• https://github.com/joewalnes/smoothie/pull/147Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368Exploit
• https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364Exploit, Third Party Advisory
• https://github.com/joewalnes/smoothie/commit/8e0920d50da82f4b6e605d56f41b69fbb9606a98Patch, Third Party Advisory
• https://github.com/joewalnes/smoothie/pull/147Patch, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-3177369Exploit, Third Party Advisory
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-3177368Exploit
• https://security.snyk.io/vuln/SNYK-JS-SMOOTHIE-3177364Exploit, Third Party Advisory

Published

Dec 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25920Rejected reason: This candidate was in a CNA pool that was n…
• CVE-2022-25921All versions of package morgan-json are vulnerable to Arbitr…9.8
• CVE-2022-25922Power Line Communications PLC4TRUCKS J2497 trailer brake con…9.1
• CVE-2022-25923Versions of the package exec-local-bin before 1.2.0 are vuln…9.8
• CVE-2022-25926Versions of the package window-control before 1.4.5 are vuln…7.8
• CVE-2022-25927Versions of the package ua-parser-js from 0.7.30 and before …7.5
• CVE-2022-2593The Better Search Replace WordPress plugin before 1.4.1 does…7.2
• CVE-2022-25931All versions of package easy-static-server are vulnerable to…7.5
• CVE-2022-25932The firmware of InHand Networks InRouter302 V3.5.45 introduc…9.8
• CVE-2022-25936Versions of the package servst before 2.0.3 are vulnerable t…7.5
• CVE-2022-25937Versions of the package glance before 3.0.9 are vulnerable t…6.5
• CVE-2022-2594The Advanced Custom Fields WordPress plugin before 5.12.3, A…8.8