{"answers":{"affected":"2 open source packages ship an affected version, including solspace/craft-freeform.","exploited":"There is no known exploitation of GHSA-44jg-mv3h-wj6g in the wild and no public exploit code.","fix":"Upgrade solspace/craft-freeform to 4.1.23 or later.","what":"GHSA-44jg-mv3h-wj6g is a cross-site scripting vulnerability in solspace/craft-freeform, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-44jg-mv3h-wj6g and fix it if it is affected.\n\nWhat it is: GHSA-44jg-mv3h-wj6g is a cross-site scripting vulnerability in solspace/craft-freeform, published on 15 Jan 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-44jg-mv3h-wj6g in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- solspace/craft-freeform (Packagist): affected all versions; fixed in 4.1.23\n- solspace/craft-freeform (Packagist): affected all versions; fixed in 4.1.23\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-44jg-mv3h-wj6g/ (Markdown: https://insights.sbomify.com/GHSA-44jg-mv3h-wj6g/index.md)","id":"GHSA-44jg-mv3h-wj6g","markdown":"https://insights.sbomify.com/GHSA-44jg-mv3h-wj6g/index.md","name":"GHSA-44jg-mv3h-wj6g","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"PHP spreadsheet library","requires_auth":"none","summary":"An XSS vulnerability in PhpSpreadsheet's HTML writer allows attackers to inject JavaScript via unsanitized styling data, potentially leading to session takeover.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\n_Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server._\n\n\\PhpOffice\\PhpSpreadsheet\\Writer\\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.\n\n### Details\n_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._\n\nSee https://github.com/advisories/GHSA-wgmf-q9vr-vww6\n\n### PoC\n_Complete instructions, including specific configuration details, to reproduce the vulnerability._\n\nExample target script:\n\n```\n\u003c?php\n\nrequire 'vendor/autoload.php';\n\n$reader = \\PhpOffice\\PhpSpreadsheet\\IOFactory::createReader(\"Xlsx\");\n$spreadsheet = $reader-\u003eload(__DIR__ . '/book.xlsx');\n\n$writer = new \\PhpOffice\\PhpSpreadsheet\\Writer\\Html($spreadsheet);\nprint($writer-\u003egenerateHTMLAll());\n```\n\nSave this file in the same directory:\n\n[book.xlsx](https://github.com/PHPOffice/PhpSpreadsheet/files/15212797/book.xlsx)\n\nOpen index.php in a web browser. An alert should be displayed.\n\n### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nFull takeover of the session of users viewing spreadsheet files as HTML.","ecosystems":["Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data","id":"GHSA-44jg-mv3h-wj6g","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Packagist","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"Packagist","fixed":["4.1.23"],"introduced":["0"],"last_affected":[],"package":"solspace/craft-freeform","purl":null,"source":"GHSA-44jg-mv3h-wj6g"},{"ecosystem":"Packagist","fixed":["4.1.23"],"introduced":["0"],"last_affected":[],"package":"solspace/craft-freeform","purl":"pkg:composer/solspace/craft-freeform","source":"GHSA-44jg-mv3h-wj6g"}],"products":null,"published":"2026-01-15","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"An XSS vulnerability in PhpSpreadsheet's HTML writer allows attackers to inject JavaScript via unsanitized styling data, potentially leading to session takeover.","url":"https://insights.sbomify.com/GHSA-44jg-mv3h-wj6g/"}