odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Summary ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore scri...

npm: odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

npm: odf-kit has HTML injection leading to XSS in odsToHtml via unescaped style attribute values vulnerability discovered by ? in WordPress npm odf-kit versions = 0.9.8, 0.14.2...

CVE-2026-113787

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...

CVE-2026-113787

The odf-kit library, which handles OpenDocument Format files in TypeScript and JavaScript, is vulnerable to HTML injection leading to Cross-site Scripting (XSS) in versions 0.10.0 through 0.14.1 . The root cause is that the renderer fails to escape inline CSS strings in the odtToHtml() function. ...

CVE-2026-113787

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an "escapeHtml" helper and applies it consistently to text content and to attribute values — "href",...

CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...

EUVD-2026-107324

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...

CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-71438

GPAC Project/MP4Box versions before v26.07.0 are vulnerable to an out-of-bounds read in the gf_odf_ac4_cfg_dsi_v1 function located in /odf/descriptors.c. An attacker can exploit this flaw by supplying a crafted AC4 file to trigger a Denial of Service (DoS) . No specific exploit details or direct ...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-120638

A heap use-after-free in the gf odf ac4 cfg clean list function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-120658

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.10.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src...

PT-2026-120607

An out-of-bounds read in gf odf ac4 cfg dsi v1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-117536

Name of the Vulnerable Software and Affected Versions GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master Description A heap buffer overflow occurs in the gf odf ac4 cfg alternative info function located in /odf/descriptors.c. This issue allows an attacker to trigger a Denial of Service...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-9380: Backport to odf-4.17.z Backport CA related fixes for NooBaa DFBUGS-7336: Backport to odf-4.17.z 5.2...

Astra Linux – Vulnerability in LibreOffice

LibreOffice supports digital signatures for ODF documents and macros within documents. It provides visual aids to indicate that the document has not been altered since the last signature, and that the signature is valid. A vulnerability in certificate validation in LibreOffice allowed attackers t...

Path Traversal

Docling is vulnerable to Path Traversal. The vulnerability is due to improper validation and confinement of attacker-controlled xlink:href filesystem paths when processing ODF images, which allows an attacker to access arbitrary readable files and potentially disclose their contents through...

Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backend

Summary The ODF backend resolves the xlink:href of a draw:image element as a filesystem path whenever the referenced part is not found inside the document archive. The value comes straight from content.xml, so it is document content, and it is used with no scheme check, no confinement to the...

PT-2026-106254

Name of the Vulnerable Software and Affected Versions Docling versions 2.107.0 through 2.120.2 Description In the ODF backend, the software improperly handles the xlink:href attribute of a draw:image element. When a referenced part is not found within the document archive, the image ref from odf...