CVE-2026-113787 · GHSA-3cgg-c5pp-57h6
odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values
- Risk score
- 45/100
- CVSS
- 6.1 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml() helper and applies it consistently to text content and to attribute values — href, src, alt, id, data-aut…
- Affected
- odf-kit (npm) >= 0.6.0, < 0.14.2
- Fix
- Upgrade odf-kit to 0.14.2 or later.
- Exploitation
- No known exploitation
Story map
At a glance
odf-kit: Yellow, plan it in. odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml() helper and applies it consistently to text content and to attribute values — href, src, alt, id, data-aut…
The flaws
- CVE-2026-113787: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values (CVSS 6.1 · EPSS 0%)
- GHSA-2rqm-h6hv-g79v: Odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values (CVSS 6.1)
The fix
Upgrade odf-kit: 0.14.2 · 0.14.0 or later on your release line
Who is exposed: odf-kit (npm) >= 0.6.0, < 0.14.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Cross-site scripting (CWE-79). 399 other warnings in 30 days
Why it is Yellow
- CVSS 6.1 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| odf-kit | npm | >= 0.6.0, < 0.14.2 | 0.14.2 |
References
- https://github.com/GitHubNewbie0/odf-kit/commit/fa3abc5a7a757f56c7212b2dbe99d1d2db995420
- https://github.com/GitHubNewbie0/odf-kit/security/advisories/GHSA-3cgg-c5pp-57h6
- https://github.com/advisories/GHSA-3cgg-c5pp-57h6
- https://nvd.nist.gov/vuln/detail/CVE-2026-113787
- https://github.com/GitHubNewbie0/odf-kit/releases/tag/v0.14.2
- https://github.com/advisories/GHSA-3cgg-c5pp-57h6
Original description
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vertical-align`. Version 0.14.2 contains a patch.
Last activity 4 Nov 2026. Patch Forecast updates every hour.