Description
This affects the package phpoffice/phpspreadsheet from 0.0.0. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML. A fix for this issue is available on commit 0ed5b800be2136bcb8fa9c1bdf59abc957a98845/master branch.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | phpoffice/phpspreadsheet | 0.0.0 – < unspecified | unspecified |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | phpoffice/phpexcel | <= 1.8.2 | — | GHSA-4mqv-gcr3-pff9 |
| Packagist | phpoffice/phpspreadsheet | < 1.16.0 | 1.16.0 | GHSA-4mqv-gcr3-pff9 |