CVE-2026-113787: odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.10.0 and prior to version 0.14.2, he renderer has an escapeHtml() helper and applies it consistently to text content and to attribute values — href, src, alt, id, data-author, data-date, citation text all go through it. The inline CSS strings do not. In renderTextSpan (dist/odt/to-html/html-renderer.js:195), the value of e.g. fo:color is copied from the document into style.fontColor verbatim by the parser (extractSpanStyle, read/parser.js:348), then concatenated raw into the attribute. A " in the value terminates the attribute early. The same unescaped style="${...}" pattern appears at roughly ten other emission sites: paragraph and heading (paragraphStyleToCss), table cells and rows (cellStyleToCss, rowStyleToCss), <col>, and the image style attribute. The affected source attributes include fo:color, fo:background-color, fo:text-shadow, fo:letter-spacing, fo:font-family (via both direct and font-face resolution), fo:margin-, fo:padding-, fo:line-height, fo:border, and style:vertical-align. Version 0.14.2 contains a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
odf-kitto a version that resolves this vulnerability.Fixed in 0.14.2
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using npm/odf-kit versions starting at 0.10.0 and before 0.14.2 are affected when they convert ODT content to HTML using the vulnerable renderer. Exposure is particularly relevant where converted HTML is presented to users.
What does an attacker need to supply?
An attacker needs to provide an ODT document containing crafted style attribute values, such as fo:color, fo:background-color, fo:font-family, margin, padding, border, or image-style values. A double quote in one of these values can terminate the generated style attribute and inject HTML.
How can I determine whether my application is affected?
Check whether the installed odf-kit version is at least 0.10.0 and earlier than 0.14.2, and whether the application uses ODT-to-HTML conversion. The vulnerable output sites include text spans, paragraphs, headings, table cells and rows, columns, and images.