# CVE-2019-11002: Materialize-css cross-site scripting in tooltip component

Source: https://junglewise.ai/threats/cve-2019-11002-materialize-css-cross-site-scripting-in-tooltip-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-04-09. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-11002 · Severity: low · CVSS 3 · Published 2019-04-09

Materialize-css is a popular front-end framework used to build responsive web interfaces. The tooltip component fails to sanitize user input, allowing attackers to inject and execute arbitrary JavaScript code in users' browsers. This could lead to session hijacking, credential theft, or malware distribution if an application displays untrusted data in tooltips.

Technologies: [@materializecss/materialize (npm)](https://junglewise.ai/threats/technologies/materializecss-materialize), [materialize-css (npm)](https://junglewise.ai/threats/technologies/materialize-css). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-11002 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-11002 being exploited in the wild.

**How severe is CVE-2019-11002?** Low severity, with a CVSS score of 3, published 9 April 2019.

**Which products and versions are affected?** @materializecss/materialize (npm) SEMVER:introduced=0,fixed=1.1.0-alpha; materialize-css (npm) SEMVER:introduced=0,last_affected=1.0.0.

**Is there a fix for CVE-2019-11002?** Yes. @materializecss/materialize (npm): upgrade to 1.1.0-alpha or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-11002 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-11002?** Check whether you run @materializecss/materialize (npm) or materialize-css (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @materializecss/materialize (npm): upgrade to 1.1.0-alpha or later

  ```sh
  npm install @materializecss/materialize@1.1.0-alpha
  ```


## Technical details

The vulnerability is a reflected cross-site scripting (XSS) flaw in the tooltip component caused by insufficient input sanitization. The component uses innerHTML or jQuery's .html() method to render user-supplied data directly as HTML without stripping JavaScript payloads, allowing an attacker to inject malicious code via tooltip attributes or dynamic content. The attack requires user interaction (hovering over or rendering a tooltip containing the malicious payload) and can be triggered if an application passes untrusted data (such as user input or unsanitized server responses) to the tooltip. No fix was initially available for affected versions up to 1.0.0, though later versions may address this issue.

## Affected products

- Materialize materialize-css all versions up to 1.0.0
- Materialize @materializecss/materialize all versions prior to 1.1.0-alpha

## Identifiers

- CVE-2019-11002
- GHSA-98f7-p5rc-jx67

## Timeline

- 2019-02-08: disclosed: Security issue reported on GitHub
- 2019-04-09: advisory: GHSA-98f7-p5rc-jx67 published
- 2019-04-09: other: CVE-2019-11002 assigned

## References

- [https://github.com/Dogfalo/materialize/issues/6286](https://github.com/Dogfalo/materialize/issues/6286)

## Related threats

- [materialize-css cross-site scripting in autocomplete](https://junglewise.ai/threats/cve-2022-25349-materialize-css-cross-site-scripting-in-autocomplete)
- [Materialize-css Cross-site Scripting in autocomplete component](https://junglewise.ai/threats/cve-2019-11003-materialize-css-cross-site-scripting-in-autocomplete-component)
- [Materialize-css XSS in Toast feature](https://junglewise.ai/threats/cve-2019-11004-materialize-css-xss-in-toast-feature)