Vulnerability · Published Feb 3, 2025 · Assigned by GitHub_M
CVE-2025-23210Bypass XSS sanitizer using the javascript protocol and special characters in phpoffice/phpspreadsheet
Medium 4.8
In plain English
A medium-severity cross-site scripting in PhpSpreadsheet from PHPOffice. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
phpoffice/phpspreadsheet is a pure PHP library for reading and writing spreadsheet files. Affected versions have been found to have a Bypass of the Cross-site Scripting (XSS) sanitizer using the javascript protocol and special characters. This issue has been addressed in versions 3.9.0, 2.3.7, 2.1.8, and 1.29.9. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | phpoffice/phpexcel | no fix listed | GHSA-r57h-547h-w24f |
| Packagist | phpoffice/phpspreadsheet | 3.9.0 | GHSA-r57h-547h-w24f |
| Packagist | phpoffice/phpspreadsheet | 1.29.9 | GHSA-r57h-547h-w24f |
| Packagist | phpoffice/phpspreadsheet | 2.3.7 | GHSA-r57h-547h-w24f |
| Packagist | phpoffice/phpspreadsheet | 2.1.8 | GHSA-r57h-547h-w24f |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHPOffice | PhpSpreadsheet | >= 3.0.0, < 3.9.0>= 2.2.0, < 2.3.7>= 2.0.0, < 2.1.8< 1.29.9 |
Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N