CVE-2022-40440

MediumCVSS 6.1

Published: 12/10/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

43th percentile - higher than 43% of all known CVEs

Summary

A cross-site scripting (XSS) vulnerability was discovered in mxGraph version 4.2.2 within the setTooltips() function. It allows injection of malicious JavaScript code due to improper input handling.

Risk Assessment

An attacker can exploit this vulnerability to execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, account takeover, or sensitive data leakage.

Recommendation

Immediately update mxGraph to a patched version or apply proper input sanitization in the setTooltips() function.

Original NVD description (English source)

mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.