GitHubNewbie0 odf-kit prior 0.14.2 CSS Renderer html-renderer.js renderTextSpan cross site scripting

Summaryinfo

A vulnerability was found in GitHubNewbie0 odf-kit. It has been declared as problematic. Affected by this vulnerability is the function renderTextSpan of the file dist/odt/to-html/html-renderer.js of the component CSS Renderer. Executing a manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2026-113787. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in GitHubNewbie0 odf-kit. This vulnerability affects the function renderTextSpan of the file dist/odt/to-html/html-renderer.js of the component CSS Renderer. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.10.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vertical-align`. Version 0.14.2 contains a patch.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-113787 since 10/20/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

Upgrading to version 0.14.2 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Bug Tracking Software

Vendor

• GitHubNewbie0

Name

• odf-kit

Website

• Product: https://github.com/GitHubNewbie0/odf-kit/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion