p PatchFirst

PatchFirst · Latest vulnerabilities

odf-kit vulnerabilities

Vulnerabilities published for odf-kit in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 1

  1. GHSA-2rqm-h6hv-g79v

    Medium · CVSS 6.1Fix available

    odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

    ### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function. ### Details Two emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-controlled values into a `style` attribute without escap

    odf-kitNode.js
    • Update to 0.14.2
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →