CVE-2020-7776: Cross-site Scripting (XSS)
This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
Other sources
This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-7776?
The severity of CVE-2020-7776 is classified as medium due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2020-7776?
To fix CVE-2020-7776, upgrade the phpoffice/phpspreadsheet package to version 1.16.0 or later.
What type of vulnerability is CVE-2020-7776?
CVE-2020-7776 is a cross-site scripting (XSS) vulnerability found in the phpoffice/phpspreadsheet library.
In which versions of phpoffice/phpspreadsheet is CVE-2020-7776 present?
CVE-2020-7776 is present in phpoffice/phpspreadsheet versions prior to 1.16.0.
Who is affected by CVE-2020-7776?
Users of phpoffice/phpspreadsheet version 1.16.0 and below are affected by CVE-2020-7776.