GHSA-2rqm-h6hv-g79v

Source

https://github.com/advisories/GHSA-2rqm-h6hv-g79v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2rqm-h6hv-g79v/GHSA-2rqm-h6hv-g79v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2rqm-h6hv-g79v

Published

2026-10-23T20:55:31Z

Modified

2026-10-23T21:00:05Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Details

Summary

ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.

Details

Two emission sites in src/ods/to-html/html-renderer.ts (before 0.14.0, src/ods-reader/html-renderer.ts) write document-controlled values into a style attribute without escaping:

Cell style. buildInlineStyle() assembles a CSS string from the cell's formatting properties (fo:color, fo:font-size, fo:font-family, fo:background-color, fo:text-align, etc.) with no escaping, and renderCell emits it raw as the cell's style attribute.
Row height. row.height (from style:row-height) is emitted raw into the row element's style attribute.

The same defect in the ODT renderer (odtToHtml()) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).

Impact

Any consumer that renders odsToHtml() output as HTML gets XSS from a crafted .ods file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.

Patches

Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:

1424227: escape style attribute values in the ODS HTML renderer
aa64c73: the shared escapeAttr helper

Users should upgrade to 0.14.2 or later.

Credit

Reported by @PethuKannan.

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-23T20:55:31Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

npm / odf-kit

Package

Name: odf-kit; View open source insights on deps.dev
Purl: pkg:npm/odf-kit

Affected ranges

Type: SEMVER
Events: Introduced

0.9.8

Fixed

0.14.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-2rqm-h6hv-g79v/GHSA-2rqm-h6hv-g79v.json"