2vulnerabilities
- Critical0 (0.0%)
- High0 (0.0%)
- Medium0 (0.0%)
- Moderate2 (100.0%)
- Low0 (0.0%)
odf-kit
Ecosystem: npm
Downloads: 35.13 K
- 0CriticalAffects 0 versions
- 0HighAffects 0 versions
- 0MediumAffects 0 versions
- 2ModerateAffects 2 versions
- 0LowAffects 0 versions
Monthly breakdown
- Critical
- High
- Medium
- Moderate
- Low
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
- 1 vulnerabilities
- Critical: 0
- High: 0
- Medium: 0
- Moderate: 1
- Low: 0
Vulnerabilities (2)
Known vulnerabilities affecting odf-kit, based on data from OSV.
| ID | Severity | Summary | Affected versions | Published | Source |
|---|---|---|---|---|---|
| GHSA-3cgg-c5pp-57h6 | Moderate | odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values### Summary ODF style attribute values are interpolated into `style="..."` attributes without HTML-escaping in **both** of odf-kit's to-HTML renderers (`odtToHtml` and `odsToHtml`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.odt` or `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of both functions. ### Details #### ODT renderer (`src/odt/to-html/html-renderer.ts`) The renderer has an `escapeH |
| GitHub (opens in a new tab) | |
| GHSA-2rqm-h6hv-g79v | Moderate | odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function. ### Details Two emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-contro |
| GitHub (opens in a new tab) |
- GHSA-3cgg-c5pp-57h6Moderateodf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values
>= 0.6.0, < 0.14.2
### Summary ODF style attribute values are interpolated into `style="..."` attributes without HTML-escaping in **both** of odf-kit's to-HTML renderers (`odtToHtml` and `odsToHtml`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.odt` or `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of both functions. ### Details #### ODT renderer (`src/odt/to-html/html-renderer.ts`) The renderer has an `escapeH
CVE: CVE-2026-113787
- GHSA-2rqm-h6hv-g79vModerateodf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
>= 0.9.8, < 0.14.2
### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function. ### Details Two emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-contro