Skip to content
OpenAdvisories

Package · npm

odf-kit

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.1
    GHSA-2rqm-h6hv-g79v

    odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

    ### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbit…

    odf-kit npm
  • Medium 6.1
    CVE-2026-113787

    odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values

    odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text …

    GitHubNewbie0 odf-kit odf-kit npm