PhpSpreadsheet versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0 contain an XSS vulnerability in the HTML Writer. The vulnerability occurs because the output escaping function htmlspecialchars() is skipped when a cell uses a custom number format containing the @ placeholder with additional literal text. This results in raw cell content being injected into the HTML output without proper escaping, enabling injection of arbitrary HTML and JavaScript. The issue is resolved in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.

An attacker able to control cell content in a spreadsheet processed by the vulnerable PhpSpreadsheet HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This could lead to cross-site scripting attacks when the HTML output is rendered in a browser context. The CVSS 4.8 score reflects a medium severity impact with network attack vector, low attack complexity, and requiring user interaction and low privileges.

Upgrading to PhpSpreadsheet versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, or 5.7.0 or later addresses this vulnerability. Since these fixed versions are identified, users should apply these official updates to remediate the issue. Patch status is not explicitly stated in the vendor advisory content, but the presence of fixed versions indicates an official fix is available. No additional mitigation steps are specified.