# GHSA-2rqm-h6hv-g79v: odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values


- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Fix available:** Yes
- **Published:** 23 Oct 2026

## What is GHSA-2rqm-h6hv-g79v?

GHSA-2rqm-h6hv-g79v is a vulnerability in odf-kit, published on 23 Oct 2026. 

### Official description

### Summary

ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.

### Details

Two emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-controlled values into a `style` attribute without escaping:

- **Cell style.** `buildInlineStyle()` assembles a CSS string from the cell's formatting properties (`fo:color`, `fo:font-size`, `fo:font-family`, `fo:background-color`, `fo:text-align`, etc.) with no escaping, and `renderCell` emits it raw as the cell's `style` attribute.
- **Row height.** `row.height` (from `style:row-height`) is emitted raw into the row element's `style` attribute.

The same defect in the ODT renderer (`odtToHtml()`) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).

### Impact

Any consumer that renders `odsToHtml()` output as HTML gets XSS from a crafted `.ods` file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.

### Patches

Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:

- [`1424227`](https://github.com/GitHubNewbie0/odf-kit/commit/1424227d1ca2716a249b623d1456575ff0331dcc): escape style attribute values in the ODS HTML renderer
- [`aa64c73`](https://github.com/GitHubNewbie0/odf-kit/commit/aa64c734ebd7e7be40e35fcda83b1144193c3da2): the shared `escapeAttr` helper

Users should upgrade to 0.14.2 or later.

### Credit

Reported by @PethuKannan.

## Which versions are affected by GHSA-2rqm-h6hv-g79v?

2 open source packages ship an affected version, including odf-kit.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `odf-kit` | npm | From 0.9.8 | 0.14.2 |
| `odf-kit` | npm | From 0.9.8 | 0.14.2 |

## How do I fix GHSA-2rqm-h6hv-g79v?

Upgrade odf-kit to 0.14.2 or later.

## Is GHSA-2rqm-h6hv-g79v being exploited?

There is no known exploitation of GHSA-2rqm-h6hv-g79v in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-2rqm-h6hv-g79v and fix it if it is affected.

What it is: GHSA-2rqm-h6hv-g79v is a vulnerability in odf-kit, published on 23 Oct 2026. 
Exploitation: There is no known exploitation of GHSA-2rqm-h6hv-g79v in the wild and no public exploit code.

Affected packages and fixed versions:
- odf-kit (npm): affected from 0.9.8; fixed in 0.14.2
- odf-kit (npm): affected from 0.9.8; fixed in 0.14.2

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-2rqm-h6hv-g79v/ (Markdown: https://insights.sbomify.com/GHSA-2rqm-h6hv-g79v/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-2rqm-h6hv-g79v

---
From sbomify Insights: https://insights.sbomify.com/GHSA-2rqm-h6hv-g79v/
Summaries are generated and may contain mistakes; the official description above is the record.