Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yODdxLWZqMjUtZjhqZs4ABCrQ

Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx

Impact

When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code.

Patches

The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.13

Workarounds

Don't use data publication via toHTMLEx

---

This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

Permalink: https://github.com/advisories/GHSA-r87q-fj25-f8jf
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yODdxLWZqMjUtZjhqZs4ABCrQ
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: about 1 month ago
Updated: about 1 month ago

CVSS Score: 6.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

EPSS Percentage: 0.00043
EPSS Percentile: 0.10912

Identifiers: GHSA-r87q-fj25-f8jf, CVE-2024-56364
References:

• https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-r87q-fj25-f8jf
• https://nvd.nist.gov/vuln/detail/CVE-2024-56364
• https://github.com/shuchkin/simplexlsx/commit/71a5e3d40d14e33161f8a40b3fd02de542218ef0
• https://github.com/advisories/GHSA-r87q-fj25-f8jf

Repository: https://github.com/shuchkin/simplexlsx
Blast Radius: 13.7

Affected Packages