PhpSpreadsheet versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0 contain a CWE-79 cross-site scripting vulnerability in the HTML Writer. The vulnerability occurs because when a cell uses a custom number format with the @ placeholder plus additional literal text, the library skips the htmlspecialchars() escaping function. This happens because the escaping is only applied if the formatted output exactly matches the original cell value. When the format includes @ with quoted literal text, the raw cell value is substituted directly into the output without escaping, enabling injection of arbitrary HTML/JavaScript. This can be exploited by an attacker who can control spreadsheet cell content processed by the HTML Writer. The issue is fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

An attacker able to control cell content in a spreadsheet processed by the vulnerable PhpSpreadsheet HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This could lead to cross-site scripting attacks when the HTML output is rendered in a browser context. The CVSS score of 4.8 indicates a medium severity impact with network attack vector, low complexity, no privileges required, and requiring user interaction.

Fixed versions are available: 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0. Users of PhpSpreadsheet should upgrade to one of these versions to remediate the vulnerability. Patch status is not explicitly stated in the vendor advisory content provided, but the presence of fixed versions indicates an official fix exists. No other mitigation guidance is provided or required.