mxGraph vulnerable to cross-site scripting in setTooltips function

Description

mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.

Recommendation

No fix is available yet. Followings are affected versions:

• <= 4.2.2

References

• GHSA-j4rv-pr9g-q8jv
• CVE-2022-40440
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• x-data-spreadsheet through 1.1.9 vulnerable to Cross-site Scripting - CVE-2022-25646
• @dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Details - CVE-2022-39350
• Smoothie vulnerable to Cross-site Scripting when tooltipLabel or strokeStyle are controlled by users - CVE-2022-25929
• mxGraph vulnerable to cross-site scripting in color field - CVE-2019-13127

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

mxgraph