npm package report

Is odf-kit safe?

1 known vulnerability, worst severity MODERATE.

// reach

0 direct dependencies

none carry a known advisory

    0 packages depend on it

    an advisory here reaches each of them

      Create a free accountfor every dependency path, dependent and what to upgrade
      // ai model usage

      Tracked for PyPI packages. HuggingFace models declare Python dependencies, so npm packages are not covered.

      cvss
      6.1
      medium

      CVSS v3.1 base score out of 10

      epss
      not scored

      chance of exploitation in 30 days

      xyz score
      not scored

      CyberXYZ composite out of 10

      fig. 01 — GHSA-2rqm-h6hv-g79v, the advisory selected below

      // 1 advisories

      GHSA-2rqm-h6hv-g79v

      MODERATEGitHub rating
      // summary

      ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.

      // details

      Two emission sites in src/ods/to-html/html-renderer.ts (before 0.14.0, src/ods-reader/html-renderer.ts) write document-controlled values into a style attribute without escaping:

      • Cell style. buildInlineStyle() assembles a CSS string from the cell's formatting properties (fo:color, fo:font-size, fo:font-family, fo:background-color, fo:text-align, etc.) with no escaping, and renderCell emits it raw as the cell's style attribute.
      • Row height. row.height (from style:row-height) is emitted raw into the row element's style attribute.

      The same defect in the ODT renderer (odtToHtml()) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).

      // impact

      Any consumer that renders odsToHtml() output as HTML gets XSS from a crafted .ods file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.

      // patches

      Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:

      • 1424227: escape style attribute values in the ODS HTML renderer
      • aa64c73: the shared escapeAttr helper

      Users should upgrade to 0.14.2 or later.

      // credit

      Reported by @PethuKannan.

      // cvss v3.1 vector

      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

      Attack vector
      Network
      Attack complexity
      Low
      Privileges required
      None
      User interaction
      Required
      Scope
      Changed
      Confidentiality
      Low
      Integrity
      Low
      Availability
      None

      Checked 2026-10-24 at 20:05 UTC. The most recent advisory here was published 2026-10-23. Updated continuously from NVD, GHSA, OSV and CNA feeds.

      Think a verdict here is wrong? Tell us — we respond within 2 business days.