CVE-2017-16022 | BDVDB-2026-101656 Detail

HackerOneMorris.js node module

Description#

Morris.js creates an svg graph, with labels that appear when hovering over a point. The hovering label names are not escaped in versions 0.5.0 and earlier. If control over the labels is obtained, script can be injected. The script will run on the client side whenever that specific graph is loaded.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://nodesecurity.io/advisories/307
https://github.com/morrisjs/morris.js/pull/464

Exploit#

No public exploit known

History#

Version 12018-06-04Record published in the CVE List.
Version 22024-09-16Most recent update recorded in the CVE List.