CVE-2020-7776 Cross-site Scripting (XSS)

High 7.1 Published 9 Dec 2020 Updated 16 Sep 2024

An attacker can execute arbitrary scripts via XSS when a spreadsheet with malicious cell comments is converted to HTML.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-7776?

CVE-2020-7776 is a high-severity cross-site scripting vulnerability in phpoffice/phpspreadsheet, published on 9 Dec 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.

Weakness: CWE-79

Which versions are affected by CVE-2020-7776?

4 open source packages ship an affected version, including phpoffice/phpspreadsheet and phpoffice/phpexcel. It affects 1 product.

Package	Affected	Fixed in
`phpoffice/phpspreadsheet` Packagist	All versions	`1.16.0`
`phpoffice/phpspreadsheet` Packagist	All versions	`1.16.0`
`phpoffice/phpexcel` Packagist	All versions to `1.8.2`	None
`phpoffice/phpexcel` Packagist	All versions to `1.8.2`	None

Products include Phpoffice Phpspreadsheet.

How do I fix CVE-2020-7776?

Upgrade phpoffice/phpspreadsheet to 1.16.0 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2020-7776 being exploited?

There is no known exploitation of CVE-2020-7776 in the wild and no public exploit code.

Sources

Also known as GHSA-4mqv-gcr3-pff9, SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856.