GHSA-r87q-fj25-f8jf: XSS
First published: Mon Dec 23 2024(Updated: )
### Impact When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. ### Patches The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.13 ### Workarounds Don't use data publication via toHTMLEx *** This vulnerability was discovered by Aleksey Solovev (Positive Technologies)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/shuchkin/simplexlsx | >=1.0.12<1.1.13 | 1.1.13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/weakness
- agent/softwarecombine
- agent/description
- agent/event
- agent/last-modified-date
- agent/references
- agent/severity
- agent/first-publish-date
- agent/type
- agent/tags
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r87q-fj25-f8jf
- alias/CVE-2024-56364
- agent/software-canonical-lookup
- package-manager/composer