odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Summary ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer odsToHtml. A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore scri...

@fileverse-dev/ddoc (>=3.0.55-comment-fix-2, <=7.1.1) potentially affected by CVE-2026-113787 via odf-kit (0.9.9)

odf-kit NPM version 0.9.9 is affected by a known vulnerability. The following packages have a transitive dependency on odf-kit and may be impacted: - @fileverse-dev/ddoc =3.0.55-comment-fix-2, =7.1.1 Source cves: CVE-2026-113787 Source advisory: GHSA-2RQM-H6HV-G79V...

npm: odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

npm: odf-kit has HTML injection leading to XSS in odsToHtml via unescaped style attribute values vulnerability discovered by ? in WordPress npm odf-kit versions = 0.9.8, 0.14.2...

CVE-2026-113787

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...

CVE-2026-113787

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an "escapeHtml" helper and applies it consistently to text content and to attribute values — "href",...

CVE-2026-113787

The odf-kit library, which handles OpenDocument Format files in TypeScript and JavaScript, is vulnerable to HTML injection leading to Cross-site Scripting (XSS) in versions 0.10.0 through 0.14.1 . The root cause is that the renderer fails to escape inline CSS strings in the odtToHtml() function. ...

@fileverse-dev/ddoc (>=3.0.55-comment-fix-2, <=7.1.1), @interview-challenge-archive/document-markdown-reader (>=0.1.3, <=0.3.2) potentially affected by CVE-2026-113787 via odf-kit (>=0.8.5, <=0.9.9)

odf-kit NPM version =0.8.5, =3.0.55-comment-fix-2, =0.1.3, =0.3.2 Source cves: CVE-2026-113787 Source advisory: MEND:CVE-2026-113787...

CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...

CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...

EUVD-2026-107324

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src,...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

GitHubNewbie0 odf-kit cross-site scripting vulnerability

In version 0.10.0 through 0.14.2 of the odf-kit for GitHubNewbie, there is a cross-site scripting vulnerability. This occurs because the HTML renderer fails to escape inline CSS style values; attributes such as fo:color are directly concatenated into the style attribute, potentially enabling...

PT-2026-120607

An out-of-bounds read in gf odf ac4 cfg dsi v1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

CVE-2025-71438

An out-of-bounds read in gfodfac4cfgdsiv1 /odf/descriptors.c in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-120638

A heap use-after-free in the gf odf ac4 cfg clean list function /odf/descriptors.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...

PT-2026-120658

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files .odt, .ods in TypeScript and JavaScript. Starting in version 0.10.0 and prior to version 0.14.2, he renderer has an escapeHtml helper and applies it consistently to text content and to attribute values — href, src...

CVE-2025-71438

An out-of-bounds read vulnerability exists in the gf_odf_ac4_cfg_dsi_v1 function (located in /odf/descriptors.c) of the GPAC Project/MP4Box software before version v26.07.0 . An attacker can exploit this flaw by providing a crafted AC4 file to trigger a Denial of Service (DoS) . While the vulnera...

PT-2026-117536

Name of the Vulnerable Software and Affected Versions GPAC Project/MP4Box version 2.5-DEV-rev1593-gfe88c3545-master Description A heap buffer overflow occurs in the gf odf ac4 cfg alternative info function located in /odf/descriptors.c. This issue allows an attacker to trigger a Denial of Service...

PT-2026-117566

A heap use-after-free in the gf odf ac4 cfg clean list function /odf/descriptors.c of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service DoS via supplying a crafted AC4 file...