CVE-2024-55878

Published: Dec 12, 2024Modified: Jun 17, 2026Deferred

6.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Exploitability: 2.3 / Impact: 4.0

Source: security-advisories@github.com (Secondary)

Description

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (2)

https://github.com/shuchkin/simplexlsx/commit/cb4e716259e83d18e89292a4f1b721f4d34e28c2

Source: security-advisories@github.com

https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-x6mh-rjwm-8ph7

Source: security-advisories@github.com

Timeline

No history available yet.