{"id":"ghsa-ghsa-2rqm-h6hv-g79v","seq":661322,"kind":"advisory","title":"odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values","url":"https://github.com/advisories/GHSA-2rqm-h6hv-g79v","permalink":"https://vulnpulse.app/items/ghsa-ghsa-2rqm-h6hv-g79v","summary":"影響: npm:odf-kit >= 0.9.8, < 0.14.2 → 0.14.2\nODF style values are interpolated into style=\"...\" attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function. Details Two emission sites in src/ods/to-html/html-renderer.t…","severity":"medium","techs":["nodejs"],"cves":[],"tags":["GHSA-2rqm-h6hv-g79v","odf-kit"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-23T20:55:31.000Z","fetched_at":"2026-10-24T04:50:51.468Z"}