GHSA-r87q-fj25-f8jf
Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | shuchkin/simplexlsx | >= 1.0.12, < 1.1.13 | 1.1.13 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code.
### Patches
The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.13
### Workarounds
Don't use data publication via toHTMLEx
***
This vulnerability was discovered by Aleksey Solovev (Positive Technologies)
References
External links from the advisory. They lead to third-party sites.