{"id":"CVE-2022-35133","aliases":["EUVD-2022-38030","GHSA-x2hc-mh8w-2vp2","MGASA-2024-0074","UBUNTU-CVE-2022-35133","openSUSE-SU-2022:10230-1","openSUSE-SU-2024:12330-1"],"status":"published","title":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute...","description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00522,"percentile":0.44551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-08-17T20:38:00Z","modified":"2026-10-28T02:30:46Z","fixes":[{"ecosystem":"Mageia:9","package":"cherrytree","fixed_in":["1.0.4-1.mga9"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"cherrytree","fixed_in":["0.99.49+3-bp154.2.3.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"cherrytree","fixed_in":["0.99.49+3-bp154.2.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:9","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.4-1.mga9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.35.10-1","0.35.11-1","0.36.2-1","0.36.3-1","0.36.4-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.37.6-1","0.37.6-1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.40+dfsg-1","0.99.43+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.99.48+dfsg-1","1.0.2+dfsg-1","1.0.2+dfsg-1build2","1.0.2+dfsg-1build3","1.1.2+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0+dfsg-1","1.2.0+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0+dfsg-1build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.0+dfsg-1build1","1.2.0+dfsg-1build2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.49+3-bp154.2.3.2"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"cherrytree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.99.49+3-bp154.2.3.2"}]}]}],"products":[{"vendor":"cherrytree_project","product":"cherrytree"}],"references":[{"url":"https://drive.google.com/file/d/1Pidkh2MAQkue81dS7SI-d16Vun_s5tot/view?usp=sharing","tags":["x_refsource_MISC","x_transferred","Permissions Required","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-35133","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x2hc-mh8w-2vp2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/35xxx/CVE-2022-35133.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0074.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31233","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-35133","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-35133","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/O3LINIV5NYLJYVZQQS73MPYNTWII3ZH2/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202513","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35133","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-35133","description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.","status":"published","published":"2022-08-17T20:38:00Z","modified":"2024-08-03T09:29:17.331Z","updated_at":"2026-11-02T14:34:39.935681Z"}],"euvd":[{"id":"EUVD-2022-38030","description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.","status":"published","published":"2022-08-17T20:38:00Z","modified":"2024-08-03T09:29:17Z","updated_at":"2026-11-03T03:25:27.391244Z"}],"ghsa":[{"id":"GHSA-x2hc-mh8w-2vp2","title":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute...","description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.","status":"published","published":"2022-08-18T00:00:15Z","modified":"2023-01-31T05:07:32Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:49:14.096889Z"}],"nvd":[{"id":"CVE-2022-35133","description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.","status":"published","published":"2022-08-17T21:15:09.477Z","modified":"2026-06-17T04:51:29.08Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:25.242752Z"}],"osv":[{"id":"UBUNTU-CVE-2022-35133","description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.","status":"published","published":"2022-08-17T21:15:00Z","modified":"2026-10-17T12:55:58.96899521Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CVE-2022-35133","description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.","status":"published","published":"2022-08-17T20:38:00Z","modified":"2026-10-28T02:30:46.511964397Z","updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"MGASA-2024-0074","title":"Updated cherrytree packages fix security vulnerability","description":"A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows\nattackers to execute arbitrary web scripts or HTML via a crafted payload\ninjected into the Name text field when creating a node. (CVE-2022-35133)\n","status":"published","published":"2024-03-20T03:35:18Z","modified":"2026-04-16T04:42:49.655145916Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2022:10230-1","title":"Security update for cherrytree","description":"\ncherrytree was updated to version 0.99.49+3:\n\n  * Legacy_canonicalize_filename: manage empty filename,\n    (gh#giuspen/cherrytree#2118)\n  * added command line option '--anchor AnchorName' that in\n    addition to existing '--node NodeName' allows to open a\n    document focusing an anchor in a node.\n  * Changed non configurable keyboard shortcuts for codebox width\n    and table column width to use parenthesis open instead of\n    backslash, (gh#giuspen/cherrytree#2113).\n  * Fixed crash on double exit from systray icon right click menu,\n    (gh#giuspen/cherrytree#2114).\n  * Added keyboard shortcuts to toolbar tooltips,\n    (gh#giuspen/cherrytree#2106).\n  * Fixed export to HTML crash, (gh#giuspen/cherrytree#2109).\n  * Force turning off portal usage since it does not work on all\n    distros, (gh#giuspen/cherrytree#2111).\n  * Improved dialog confirmation before executing the code.\n  * Additonal changes for core22, (gh#giuspen/cherrytree#2110).\n  * Allow to disable the dialog asking for confirmation before\n    executing the code.\n  * Fixed bulleted list unindent (Shift+Tab) crash,\n    (gh#giuspen/cherrytree#2103).\n  * Add home plug, (gh#giuspen/cherrytree#2101 and\n    gh#giuspen/cherrytree#2102).\n  * Linux menu launcher run cherrytree in a new instance,\n    (gh#giuspen/cherrytree#2077).\n  * Fixed crash on print/export as pdf of a sequence of characters\n    without spaces longer that the page width, such as a very long\n    URL, (gh#giuspen/cherrytree#2045).\n  * Fixed wrongly entering column mode when using keyboard\n    shortcuts with \u003cCtrl\u003e\u003cAlt\u003e such as insert codebox,\n    (gh#giuspen/cherrytree#2075).\n  * Added syntax highlighting support for GDScript.\n  * Fixed tooltip and cursor not reset after hovering link and then\n    navigating to non rich text node.\n  * Support for accent insensitive search - added letters with\n    subordinate dots, (gh#giuspen/cherrytree#1981).\n  * Translation updates.\n- Developer advised fixed cross-site scripting (XSS) vulnerability\n  that allows attackers to execute arbitrary web scripts or HTML\n  via a crafted payload injected into the Name text field when\n  creating a node, (boo#1202513, gh#giuspen/cherrytree#2099 and\n  CVE-2022-35133).\n\nUpdate to version 0.99.48:\n\n  * Added support for right to left languages in export to html and\n    pdf (gh#giuspen/cherrytree#2044, gh#giuspen/cherrytree#1668\n    and gh#giuspen/cherrytree# #698).\n  * In order to support the right to left languages in export to\n    html, the resulting html text lines are no longer LINE\u003cbr/\u003e but\n    \u003cp\u003eLINE\u003c/p\u003e.\n  * Fixed in export to pdf the link to node+anchor with non ascii\n    anchor name.\n  * Improved detection of missing executables required for\n    rendering LatexBoxes. These dependencies are no longer\n    mandatory (gh#giuspen/cherrytree#2033).\n  * Added help to the user to show again a hidden menubar\n    (gh#giuspen/cherrytree#1927 and gh#giuspen/cherrytree#2054).\n  * Pressing Tab on the very latest table cell now adds a new table\n    line and moves to its first cell.\n  * Fixed issue with relative links to files and folders and\n    documents moved between linux and windows.\n  * In export to html and txt multiple files, now appending the\n    node id to the file names to support multiple nodes with the\n    same name.\n  * Added syntax highlight support for solidity\n    (gh#giuspen/cherrytree#2030).\n  * After issues with the domain giuspen.com, the domain changed to\n    giuspen.net and giuspen.com will eventually go.\n\nUpdate to version 0.99.47+2:\n\n  * Added support for latex math equations.\n  * Added copy/paste of tree nodes and subnodes between multiple opened files.\n  * Restored support for drag and drop of text selection.\n    Now rich text content is preserved.\n  * Added syntax highlighting for HCL.\n  * Fixed issue at reset toolbar in preferences dialog when menubar in titlebar.\n  * Added command line option (-S/--secondary_session) to run in isolation\n    from a possibly already running main instance.\n  * Updated flatpak script.\n\nUpdate to version 0.99.46+6:\n\n  * Fixed time created/modified filter on searches for node name and tags.\n  * Changed default keyboard shortcuts using Ctrl+Period to Ctrl+Backslash\n    for clash with latest linux desktops.\n  * Fixed restore window position on Windows and dual screen.\n  * Added strip trailing spaces action to rich text right click menu.\n  * Fixed issue restoring hpaned tree/text position with tree on the right.\n  * Added command line option to pass the password to open an encrypted document.\n\nUpdate to version 0.99.45+10:\n\n  * added language Arabic\n  * fixed time created/modified filter on searches for node name and tags \n  * just ninja build debug print\n  * added strip trailing spaces action to rich text right click menu\n  * minor improvement to previous commit \n  * fixed copy fromm codebox and pasting to rich text unwanted additional characters \n","status":"published","published":"2022-12-04T09:01:32Z","modified":"2026-02-04T02:46:03.066855Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12330-1","title":"cherrytree-0.99.49+3-1.1 on GA media","description":"These are all security issues fixed in the cherrytree-0.99.49+3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:39:27.626401Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}