GHSA-44jg-mv3h-wj6g

Suggest an improvement
Source
https://github.com/advisories/GHSA-44jg-mv3h-wj6g
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-44jg-mv3h-wj6g/GHSA-44jg-mv3h-wj6g.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-44jg-mv3h-wj6g
Published
2026-01-15T22:40:42Z
Modified
2026-02-03T03:17:27Z
Severity
  • 1.9 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P CVSS Calculator
Summary
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
Details

Summary

Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.

\PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.

Details

Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.

See https://github.com/advisories/GHSA-wgmf-q9vr-vww6

PoC

Complete instructions, including specific configuration details, to reproduce the vulnerability.

Example target script:

<?php

require 'vendor/autoload.php';

$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');

$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
print($writer->generateHTMLAll());

Save this file in the same directory:

book.xlsx

Open index.php in a web browser. An alert should be displayed.

Impact

What kind of vulnerability is it? Who is impacted?

Full takeover of the session of users viewing spreadsheet files as HTML.

Database specific 
{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-01-15T22:40:42Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}
References

Affected packages

Packagist / solspace/craft-freeform

Package

Name
solspace/craft-freeform
Purl
pkg:composer/solspace/craft-freeform

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.1.23

Affected versions

2.*
2.0.0-beta.1
2.0.0-beta.2
2.0.0-beta.3
2.0.0-beta.4
2.0.0-beta.5
2.0.0-beta.6
2.0.0-beta.7
2.0.0-beta.8
2.0.0-beta.9
2.0.0-beta.10
2.0.0-beta.11
2.0.0-beta.12
2.0.0-beta.13
2.0.0-beta.14
2.0.0-beta.15
2.0.0-beta.16
2.0.0-beta.17
2.0.0-beta.18
2.0.0-beta.19
2.0.0-beta.20
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.2.0
2.2.1
2.2.2
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.4.0
2.4.1
2.4.2
2.4.3
2.5.0
2.5.1
2.5.2
2.5.3
2.5.4
2.5.5
2.5.6
2.5.7
2.5.8
2.5.9
2.5.10
2.5.11
2.5.12
2.5.13
2.5.14
2.5.15
2.5.16
2.5.17
2.5.18
2.5.19
2.5.20
2.5.21
2.5.22
2.5.23
2.5.24
2.5.25
2.5.26
2.5.27
3.*
3.0.0-beta.1
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.1.0
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.5.6
3.5.7
3.5.8
3.5.9
3.5.10
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
3.6.10
3.6.11
3.6.12
3.7.0
3.7.1
3.7.2
3.7.3
3.7.4
3.7.5
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.9.0
3.9.1
3.9.2
3.9.3
3.9.4
3.9.5
3.9.6
3.9.7
3.9.8
3.9.9
3.9.10
3.9.11
3.10.0-beta.1
3.10.0-beta.2
3.10.0-beta.3
3.10.0-beta.4
3.10.0-beta.5
3.10.0-beta.6
3.10.0
3.10.1
3.10.2
3.10.2.1
3.10.3
3.10.4
3.10.5
3.10.6
3.10.7
3.10.8
3.10.9
3.10.10
3.10.11
3.11.0-beta.1
3.11.0-beta.2
3.11.0-beta.3
3.11.0-beta.4
3.11.0-beta.5
3.11.0-beta.6
3.11.0
3.11.1
3.11.2
3.11.3
3.11.4
3.11.4.1
3.11.5
3.11.6
3.11.7
3.11.8
3.11.9
3.11.10
3.11.11
3.11.11.1
3.11.12
3.11.13
3.11.13.1
3.12.0-beta.3
3.12.0-beta.4
3.12.0-beta.5
3.12.0-beta.6
3.12.0-beta.7
3.12.0-beta.8
3.12.0-beta.9
3.12.0-beta.10
3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.12.9.1
3.12.10
3.12.11
3.12.12
3.12.12.1
3.12.13
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.13.5
3.13.5.1
3.13.6
3.13.7
3.13.8
3.13.9
3.13.10
3.13.11
3.13.12
3.13.13
3.13.14
3.13.15
3.13.16
3.13.17
3.13.18
3.13.19
3.13.20
3.13.21
3.13.22
3.13.22.1
3.13.23
3.13.24
3.13.25
3.13.26
3.13.27
3.13.28
3.13.29
3.13.30
3.13.31
3.13.32
3.13.33
3.13.34
3.13.35
3.13.36
3.13.37
3.13.38
4.*
4.0.0-beta.1
4.0.0-beta.2
4.0.0-beta.3
4.0.0-beta.4
4.0.0-beta.5
4.0.0-beta.6
4.0.0-beta.7
4.0.0-beta.8
4.0.0-beta.9
4.0.0-beta.10
4.0.0-beta.11
4.0.0-beta.12
4.0.0-beta.13
4.0.0-beta.14
4.0.0-beta.15
4.0.0-beta.15.1
4.0.0-beta.16
4.0.0-beta.17
4.0.0-beta.18
4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10
4.0.11
4.0.12
4.0.13
4.0.14
4.0.15
4.0.16
4.0.17
4.0.18
4.0.19
4.0.20
4.0.21
4.0.22
4.0.23
4.0.24
4.0.24.1
4.0.25
4.0.26
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6
4.1.7
4.1.8
4.1.9
4.1.10
4.1.11
4.1.12
4.1.12.1
4.1.13
4.1.14
4.1.15
4.1.15.1
4.1.16
4.1.17
4.1.18
4.1.19
4.1.20
4.1.21
4.1.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-44jg-mv3h-wj6g/GHSA-44jg-mv3h-wj6g.json"