CVE-2026-35453 PhpSpreadsheet XSS via number format text substitution in HTML Writer
Attackers can inject arbitrary HTML and JavaScript into spreadsheet outputs via the HTML Writer, potentially leading to code execution in consuming applications.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-35453?
CVE-2026-35453 is a medium-severity cross-site scripting vulnerability in PHPOffice PhpSpreadsheet, published on 5 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
PhpSpreadsheet is a library for reading and writing spreadsheet files. In versions 1.30.3 and earlier, 2.0.0 through 2.1.15, 2.2.0 through 2.4.4, 3.3.0 through 3.10.4, and 4.0.0 through 5.6.0, the HTML Writer skips htmlspecialchars() output escaping when a cell uses a custom number format containing the @ text placeholder with additional literal text (e.g., @ "items"). The escaping is only applied when the formatted output strictly equals the original cell value. When the format code contains @ with quoted literal text, the formatter substitutes the raw cell value into the format string and returns early without invoking the escaping callback. An attacker who can control cell content in a spreadsheet processed by the HTML Writer can inject arbitrary HTML and JavaScript into the generated output. This issue has been fixed in versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-35453?
10 open source packages ship an affected version, including phpoffice/phpspreadsheet. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
phpoffice/phpspreadsheet Packagist | All versions | 1.30.4 |
phpoffice/phpspreadsheet Packagist | All versions | 1.30.4 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.16 |
phpoffice/phpspreadsheet Packagist | From 2.0.0 | 2.1.16 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.5 |
phpoffice/phpspreadsheet Packagist | From 2.2.0 | 2.4.5 |
4 more packages
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.5 |
phpoffice/phpspreadsheet Packagist | From 3.3.0 | 3.10.5 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.7.0 |
phpoffice/phpspreadsheet Packagist | From 4.0.0 | 5.7.0 |
Products include Phpoffice Phpspreadsheet.
How do I fix CVE-2026-35453?
Upgrade phpoffice/phpspreadsheet to a fixed version for your release line: 1.30.4, 2.1.16, 2.4.5 or 3.10.5.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-35453 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35453 exists.
Other vulnerabilities in PHPOffice PhpSpreadsheet
- CVE-2026-34084 PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFactory::load
- CVE-2024-45048 XML External Entity Reference (XXE) in PHPSpreadsheet
- CVE-2019-12331 XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue
- CVE-2018-19277 XXE in PHPSpreadsheet due to encoding issue
- CVE-2024-56365 PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class
Sources
Also known as GHSA-6wpp-88cp-7q68.