GHSA-2rqm-h6hv-g79v

Summary

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Severity

medium

CVSS

6.1

CWE

CWE-79

Published

2026-10-23

Updated

2026-10-23

Advisory details

Summary

ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.

Details

Two emission sites in src/ods/to-html/html-renderer.ts (before 0.14.0, src/ods-reader/html-renderer.ts) write document-controlled values into a style attribute without escaping:

• Cell style. buildInlineStyle() assembles a CSS string from the cell's formatting properties (fo:color, fo:font-size, fo:font-family, fo:background-color, fo:text-align, etc.) with no escaping, and renderCell emits it raw as the cell's style attribute.
• Row height. row.height (from style:row-height) is emitted raw into the row element's style attribute.

The same defect in the ODT renderer (odtToHtml()) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).

Impact

Any consumer that renders odsToHtml() output as HTML gets XSS from a crafted .ods file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.

Patches

Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:

• 1424227: escape style attribute values in the ODS HTML renderer
• aa64c73: the shared escapeAttr helper

Users should upgrade to 0.14.2 or later.

Credit

Reported by @PethuKannan.

References

• https://github.com/advisories/GHSA-2rqm-h6hv-g79v
• https://github.com/GitHubNewbie0/odf-kit/security/advisories/GHSA-2rqm-h6hv-g79v
• https://github.com/GitHubNewbie0/odf-kit/commit/1424227d1ca2716a249b623d1456575ff0331dcc

Related advisories

• GHSA-cg2g-xh64-v4q7 — critical · npm/dompurify
• CVE-2026-102989 — critical · npm/@tanstack/start-server-core
• CVE-2026-104252 — critical · Go/vitess.io/vitess
• CVE-2026-107845 — critical · Packagist/contao/comments-bundle
• CVE-2026-106102 — critical · npm/quasar
• CVE-2026-10032 — critical · npm/@a2ui/web_core
• CVE-2026-59167 — critical · npm/suneditor
• CVE-2026-75828 — critical · Packagist/getgrav/grav

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Summarize with AI

ChatGPTClaudePerplexity