CVE-2024-45292

Summary

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

Severity

medium

EPSS

0.3% (p23)

Also known as

GHSA-r8w8-74ww-j4wh#phpoffice/phpexcel, GHSA-r8w8-74ww-j4wh#phpoffice/phpspreadsheet

Published

2024-10-07

References

• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh
• https://nvd.nist.gov/vuln/detail/CVE-2024-45292
• https://github.com/PHPOffice/PhpSpreadsheet/commit/392dd08c5569b623060784e1333454d64df1f03d

Related advisories

• CVE-2026-45034 — critical · Packagist/phpoffice/phpspreadsheet
• CVE-2026-34084 — critical · Packagist/phpoffice/phpspreadsheet
• CVE-2026-40902 — high · Packagist/phpoffice/phpspreadsheet
• CVE-2026-40863 — high · Packagist/phpoffice/phpspreadsheet
• CVE-2025-54370 — high · Packagist/phpoffice/phpspreadsheet
• CVE-2024-56409 — high · Packagist/phpoffice/phpspreadsheet
• CVE-2024-56366 — high · Packagist/phpoffice/phpspreadsheet
• CVE-2024-56365 — high · Packagist/phpoffice/phpspreadsheet

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity