Junglewise Threat Intelligence

CVE-2022-40440: mxGraph cross-site scripting in setTooltips function

CVE-2022-40440 · Severity: low · CVSS 3.1 · Published 2022-10-12

Technologies: mxgraph (npm). Vendors: npm.

Executive brief

mxGraph is a JavaScript library for building interactive diagrams and flowcharts in web applications. A cross-site scripting vulnerability in the tooltip feature allows attackers to inject malicious scripts that execute when a user hovers over diagram elements, potentially compromising user data or session security.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in mxGraph's setTooltips() function that fails to properly sanitize user-supplied content before rendering it via innerHTML. When the setTooltips feature is enabled, the mxTooltipHandler uses innerHTML to display custom cell values without sanitization, allowing attackers to inject arbitrary HTML/JavaScript. The attack requires no authentication and is triggered through user interaction (hovering over a diagram element). An attacker can inject malicious code into cell values (e.g., <iframe src=javascript:alert(1)>) that executes in the victim's browser when tooltips are displayed. The vulnerability affects mxGraph version 4.2.2 and likely all earlier versions; patch status is unclear from available sources.

Affected products

  • jgraph mxGraph through 4.2.2

Timeline

  • 2022-10-12: disclosed

References

Related threats