GHSA-2rqm-h6hv-g79v: XSS
Summary
ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.
Details
Two emission sites in src/ods/to-html/html-renderer.ts (before 0.14.0, src/ods-reader/html-renderer.ts) write document-controlled values into a style attribute without escaping:
- Cell style. buildInlineStyle() assembles a CSS string from the cell's formatting properties (fo:color, fo:font-size, fo:font-family, fo:background-color, fo:text-align, etc.) with no escaping, and renderCell emits it raw as the cell's style attribute. - Row height. row.height (from style:row-height) is emitted raw into the row element's style attribute.
The same defect in the ODT renderer (odtToHtml()) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).
Impact
Any consumer that renders odsToHtml() output as HTML gets XSS from a crafted .ods file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.
Patches
Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:
- 1424227: escape style attribute values in the ODS HTML renderer - aa64c73: the shared escapeAttr helper
Users should upgrade to 0.14.2 or later.
Credit
Reported by @PethuKannan.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/odf-kitto a version that resolves this vulnerability.Fixed in 0.14.2 - Upgrade
Upgrade
odf-kitto a version that resolves this vulnerability.Fixed in 0.14.2
Event History
Frequently Asked Questions
Which deployments are exposed to script execution?
Deployments are exposed when they process attacker-controlled .ods files with odsToHtml() and insert the resulting output as HTML. The issue affects ODS-to-HTML rendering; the impact depends on rendered HTML being placed in a browser-consumed HTML context.
What must an attacker control to exploit this?
An attacker needs to supply a crafted .ods file containing a double quote in a document-controlled style value. Relevant inputs include cell formatting properties used to build inline CSS and the style:row-height value.
How can I determine whether my application is affected?
Check whether it uses odf-kit's odsToHtml() and accepts or processes ODS files from untrusted sources. Versions before 0.14.0 contain the affected emission sites, where cell styles or row heights are written into style attributes without HTML escaping.
What can be done while an upgrade is not available?
Do not render untrusted ODS files through odsToHtml() into HTML contexts. Treat generated HTML from untrusted documents as unsafe unless the relevant style-derived values are escaped before insertion.