odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
影響: npm:odf-kit >= 0.9.8, < 0.14.2 → 0.14.2
ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function. Details Two emission sites in src/ods/to-html/html-renderer.t…
| 情報源 | GitHub Advisory Database |
|---|---|
| 取得日時 | 2026/10/24 13:50 |
| データ | Markdown JSON |
2026/10/24 05:55、GitHub Advisory Databaseが「odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「警告」(medium) です。関連する技術: JavaScript / Node.js。