Vulnerability · Published Dec 12, 2024 · Assigned by GitHub_M
CVE-2024-55878Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx
Medium 6.8
In plain English
A medium-severity cross-site scripting in simplexlsx from shuchkin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | shuchkin/simplexlsx | 1.1.12 | GHSA-x6mh-rjwm-8ph7 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| shuchkin | simplexlsx | >= 1.0.12, < 1.1.12 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N