How severe is GHSA-2rqm-h6hv-g79v?

GHSA-2rqm-h6hv-g79v has a CVSS score of 6.1/10, rated MEDIUM. Review your exposure and patch according to your risk tolerance.

Which packages are affected by GHSA-2rqm-h6hv-g79v?

GHSA-2rqm-h6hv-g79v affects the following packages: odf-kit (npm). Ecosystems affected: npm.

How do I fix GHSA-2rqm-h6hv-g79v?

Update odf-kit to 0.14.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2rqm-h6hv-g79v is resolved across your whole dependency graph.

How do I detect GHSA-2rqm-h6hv-g79v in my npm dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for odf-kit, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate GHSA-2rqm-h6hv-g79v if there is no patch (or I can't update yet)?

Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Is GHSA-2rqm-h6hv-g79v actively exploited in the wild?

No public exploit code has been indexed for GHSA-2rqm-h6hv-g79v yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

When was GHSA-2rqm-h6hv-g79v published, and has it been updated?

GHSA-2rqm-h6hv-g79v was published on October 23, 2026 and was last updated on October 23, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

📦

📦 npm

Not in CISA KEV

MEDIUM severity

odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute valuesGHSA-2rqm-h6hv-g79v

MEDIUMFix: GitHubNewbie0/odf-kit@1424227

GHSA-2rqm-h6hv-g79v is a medium-severity (CVSS 6.1) vulnerability in odf-kit. A fix is available for odf-kit — see the affected versions and patch details below.

Published

Oct 23, 2026

Updated

Oct 23, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Oct 23, 2026 · OSV.dev, FIRST.org (EPSS)

Real-World Exposure

1 pkg affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

2other npm packages depend on this — each one inherits the vulnerability until it's patched upstream

odf-kitnpm

4Kdownloads / week

Description

Summary

ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.

Details

Two emission sites in src/ods/to-html/html-renderer.ts (before 0.14.0, src/ods-reader/html-renderer.ts) write document-controlled values into a style attribute without escaping:

Cell style. buildInlineStyle() assembles a CSS string from the cell's formatting properties (fo:color, fo:font-size, fo:font-family, fo:background-color, fo:text-align, etc.) with no escaping, and renderCell emits it raw as the cell's style attribute.
Row height. row.height (from style:row-height) is emitted raw into the row element's style attribute.

The same defect in the ODT renderer (odtToHtml()) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).

Impact

Any consumer that renders odsToHtml() output as HTML gets XSS from a crafted .ods file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.

Patches

Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:

1424227: escape style attribute values in the ODS HTML renderer
aa64c73: the shared escapeAttr helper

Users should upgrade to 0.14.2 or later.

Credit

Reported by @PethuKannan.

Affected Packages

1 total 1 fixed

Ecosystem	Package	Vulnerable range	Fix
📦npm	`odf-kit`	≥ 0.9.8&&< 0.14.2	0.14.2`npm install odf-kit@0.14.2`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for odf-kit, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update odf-kit to 0.14.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms GHSA-2rqm-h6hv-g79v is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Summary ODF style values are interpolated into `style="..."` attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (`odsToHtml()`). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted `.ods` file wherever the rendered output is inserted as HTML, which is the documented purpose of the function. ### Details Two emission sites in `src/ods/to-html/html-renderer.ts` (before 0.14.0, `src/ods-reader/html-renderer.ts`) write document-contro

O3 Security · Impact-Aware SCA

Is GHSA-2rqm-h6hv-g79v in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works