CVE-2022-39240: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in MyGraph

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-09-24 · updated 2026-06-17
Weakness: CWE-79

Description

MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue is patched in version 1.0.4. There is no known workaround.

Affected products

renlm MyGraph: before 1.0.4 — fixed in 1.0.4

How to fix

Upgrade to a fixed version: renlm MyGraph 1.0.4. Check the vendor advisory for mitigations.

References

https://github.com/renlm/MyGraph/security/advisories/GHSA-hj4j-923h-927j
https://github.com/renlm/MyGraph/security/advisories/GHSA-hj4j-923h-927j

Get alerted when CVE-2022-39240 or the next vulnerability affects your stack