CVE-2022-25929: Smoothiecharts Smoothie Charts

Medium severity, CVSS 5.4. EPSS: 0.8% chance of exploitation in the next 30 days.

The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tooltipLabel properties. Exploiting this vulnerability is possible when the user can control these properties.

Affected products

• Smoothiecharts Smoothie Charts: from 1.31.0, before 1.36.1 (fixed in 1.36.1)

Published 2022-12-21. Last modified 2026-06-17.