CVE-2026-113787

Awaiting Analysis Awaiting Analysis - Queue

XSS via Unescaped CSS in odf-kit

Publication date: 2026-10-21

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), ``, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vertical-align`. Version 0.14.2 contains a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-30

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-09

NVD

CVE-2026-113787

EUVD

EUVD-2026-107324

Affected Vendors & Products

Vendor	Product	Version / Range
GitHubNewbie0	odf-kit	>= 0.10.0, < 0.14.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in the odf-kit library. It affects versions from 0.6.0 up to but not including 0.14.2. The issue occurs in the ODT to HTML renderer where style attribute values from ODF documents are inserted into HTML style attributes without proper escaping. Attackers can craft malicious .odt files with poisoned style values containing double-quote characters to inject arbitrary HTML and JavaScript.

Detection Guidance

Check if your system uses odf-kit versions between 0.6.0 and 0.14.2. Inspect HTML output from ODF files for unescaped style attributes or script tags. Look for double-quotes in style values like fo:color or fo:background-color.

Impact Analysis

If you use the affected odf-kit versions to render ODF files into HTML, an attacker could exploit this to inject malicious scripts into the rendered HTML. When this HTML is viewed in a browser, the injected script could execute with the page's origin, potentially stealing data, session cookies, or performing actions on behalf of the user.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if exploited in healthcare applications. Both regulations require protecting data from unauthorized access or disclosure.

Mitigation Strategies

Upgrade odf-kit to version 0.14.2 or later. If upgrading is not possible, manually escape all style attribute values in the HTML renderer, particularly those containing CSS properties like color, background-color, or font-family.

Hi! I’m here to help you understand CVE-2026-113787. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...