Threats tagged 'ghsa-3cgg-c5pp-57h6'

The odf-kit library versions from 0.6.0 up to but not including 0.14.2 contain an HTML injection vulnerability in the odtToHtml() and odsToHtml() functions. This occurs because style attribute values from ODF documents are inserted into HTML style attributes without proper escaping, allowing an attacker to inject arbitrary HTML and execute scripts (XSS) via crafted .odt or .ods files. The issue affects multiple style attributes and is present in both the ODT and ODS to-HTML renderers. A fix is available in version 0.14.2.