{"answers":{"affected":"2 open source packages ship an affected version, including odf-kit.","exploited":"There is no known exploitation of GHSA-2rqm-h6hv-g79v in the wild and no public exploit code.","fix":"Upgrade odf-kit to 0.14.2 or later.","what":"GHSA-2rqm-h6hv-g79v is a vulnerability in odf-kit, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for GHSA-2rqm-h6hv-g79v and fix it if it is affected.\n\nWhat it is: GHSA-2rqm-h6hv-g79v is a vulnerability in odf-kit, published on 23 Oct 2026. \nExploitation: There is no known exploitation of GHSA-2rqm-h6hv-g79v in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- odf-kit (npm): affected from 0.9.8; fixed in 0.14.2\n- odf-kit (npm): affected from 0.9.8; fixed in 0.14.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-2rqm-h6hv-g79v/ (Markdown: https://insights.sbomify.com/GHSA-2rqm-h6hv-g79v/index.md)","id":"GHSA-2rqm-h6hv-g79v","markdown":"https://insights.sbomify.com/GHSA-2rqm-h6hv-g79v/index.md","name":"GHSA-2rqm-h6hv-g79v","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n\nODF style values are interpolated into `style=\"...\"` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.\n\n### Details\n\nTwo emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-controlled values into a `style` attribute without escaping:\n\n- **Cell style.** `buildInlineStyle()` assembles a CSS string from the cell's formatting properties (`fo:color`, `fo:font-size`, `fo:font-family`, `fo:background-color`, `fo:text-align`, etc.) with no escaping, and `renderCell` emits it raw as the cell's `style` attribute.\n- **Row height.** `row.height` (from `style:row-height`) is emitted raw into the row element's `style` attribute.\n\nThe same defect in the ODT renderer (`odtToHtml()`) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).\n\n### Impact\n\nAny consumer that renders `odsToHtml()` output as HTML gets XSS from a crafted `.ods` file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.\n\n### Patches\n\nFixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:\n\n- [`1424227`](https://github.com/GitHubNewbie0/odf-kit/commit/1424227d1ca2716a249b623d1456575ff0331dcc): escape style attribute values in the ODS HTML renderer\n- [`aa64c73`](https://github.com/GitHubNewbie0/odf-kit/commit/aa64c734ebd7e7be40e35fcda83b1144193c3da2): the shared `escapeAttr` helper\n\nUsers should upgrade to 0.14.2 or later.\n\n### Credit\n\nReported by @PethuKannan.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values","id":"GHSA-2rqm-h6hv-g79v","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["0.14.2"],"introduced":["0.9.8"],"last_affected":[],"package":"odf-kit","purl":null,"source":"GHSA-2rqm-h6hv-g79v"},{"ecosystem":"npm","fixed":["0.14.2"],"introduced":["0.9.8"],"last_affected":[],"package":"odf-kit","purl":"pkg:npm/odf-kit","source":"GHSA-2rqm-h6hv-g79v"}],"products":null,"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/GHSA-2rqm-h6hv-g79v/"}