CVE-2026-113787
- Source
- https://cve.org/CVERecord?id=CVE-2026-113787
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-113787.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-113787
- Aliases
-
- GHSA-3cgg-c5pp-57h6
- Published
- 2026-10-21T15:25:43Z
- Modified
- 2026-10-22T10:45:48Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values
- Details
-
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an
escapeHtml()helper and applies it consistently to text content and to attribute values —href,src,alt,id,data-author,data-date, citation text all go through it. The inline CSS strings do not. InrenderTextSpan(dist/odt/to-html/html-renderer.js:195), the value of e.g.fo:coloris copied from the document intostyle.fontColorverbatim by the parser (extractSpanStyle, read/parser.js:348), then concatenated raw into the attribute. A"in the value terminates the attribute early. The same unescapedstyle="${...}"pattern appears at roughly ten other emission sites: paragraph and heading (paragraphStyleToCss), table cells and rows (cellStyleToCss,rowStyleToCss),<col>, and the image style attribute. The affected source attributes includefo:color,fo:background-color,fo:text-shadow,fo:letter-spacing,fo:font-family(via both direct and font-face resolution),fo:margin-*,fo:padding-*,fo:line-height,fo:border*, andstyle:vertical-align. Version 0.14.2 contains a patch. - Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113787.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/113xxx/CVE-2026-113787.json
- https://github.com/GitHubNewbie0/odf-kit/commit/fa3abc5a7a757f56c7212b2dbe99d1d2db995420
- https://github.com/GitHubNewbie0/odf-kit/security/advisories/GHSA-3cgg-c5pp-57h6
- https://nvd.nist.gov/vuln/detail/CVE-2026-113787
Affected packages
Git / github.com/githubnewbie0/odf-kit
Affected ranges
- Type
- GIT
- Repo
- https://github.com/githubnewbie0/odf-kit
- Events
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0.6.0" }, { "fixed": "0.14.2" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "fa3abc5a7a757f56c7212b2dbe99d1d2db995420" } ], "source": "REFERENCES_COMMIT" } ] }