Executive brief
mxGraph is a JavaScript library for building interactive diagrams and flowcharts in web applications. A cross-site scripting vulnerability in the tooltip feature allows attackers to inject malicious scripts that execute when a user hovers over diagram elements, potentially compromising user data or session security.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in mxGraph's setTooltips() function that fails to properly sanitize user-supplied content before rendering it via innerHTML. When the setTooltips feature is enabled, the mxTooltipHandler uses innerHTML to display custom cell values without sanitization, allowing attackers to inject arbitrary HTML/JavaScript. The attack requires no authentication and is triggered through user interaction (hovering over a diagram element). An attacker can inject malicious code into cell values (e.g., <iframe src=javascript:alert(1)>) that executes in the victim's browser when tooltips are displayed. The vulnerability affects mxGraph version 4.2.2 and likely all earlier versions; patch status is unclear from available sources.
Affected products
- jgraph mxGraph through 4.2.2
Timeline
- 2022-10-12: disclosed