-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the tooltipFormatter function building HTML through unsafe string concatenation of user-controlled properties. The commit diff shows the original implementation used innerHTML with raw user input in strokeStyle and tooltipLabel, while the patch switched to DOM element creation methods (createElement, createTextNode) to prevent HTML injection. The function's direct handling of these user-controlled properties in HTML generation makes it the clear vulnerable entry point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| smoothie | npm | >= 1.31.0, < 1.36.1 | 1.36.1 |