CVE-2026-113787

The odf-kit library, which handles OpenDocument Format files in TypeScript and JavaScript, is vulnerable to HTML injection leading to Cross-site Scripting (XSS) in versions 0.10.0 through 0.14.1 . The root cause is that the renderer fails to escape inline CSS strings in the odtToHtml() function. ...