odf-kit EUVD-2026-107324

Exploitation requires that a consumer of odf-kit (version 0.10.0 up to but not including 0.14.2) uses the ODT-to-HTML renderer to convert an attacker-controlled ODF document AND then displays the generated HTML in a browser or HTML-rendering context. The concrete injection vector is any unescaped inline-CSS attribute value - specifically fo:color, fo:background-color, fo:text-shadow, fo:letter-spacing, fo:font-family, fo:margin-*, fo:padding-*, fo:line-height, fo:border*, and style:vertical-align - which are concatenated raw into style="..." at renderTextSpan and ~ten other emission sites (paragraph/heading, table cell/row, <col>, and image style). The limiting factors are: the attacker must get a crafted document to the victim and the victim must actually render it to HTML (UI:R), and the output HTML must be served/displayed without an additional downstream sanitizer. Pure parsing or non-HTML conversion does not trigger the flaw.

This is a cross-site scripting flaw (CWE-79) in the odf-kit ODF-to-HTML renderer, rated CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The vector is credible and well-matched to the described flaw: the renderer applies escapeHtml() to text and most attributes but NOT to inline CSS strings, so a double-quote inside a style value (e.g. fo:color) terminates the style attribute early and lets an attacker inject arbitrary attributes/event handlers - a textbook stored/attribute-breakout XSS. The scope change (S:C) is justified because injected script executes in the security context of whatever renders the produced HTML, not the library itself. However, exploitation is gated by UI:R: a victim must render or convert an attacker-supplied ODF document, so this is not wormable or spray-and-pray. No EPSS score, KEV listing, or public POC was provided in the input; the only linked exploit-adjacent artifact is the fix commit, which is a patch, not a weaponized exploit. There is no conflict between signals, but the absence of EPSS/KEV data means real-world exploitation likelihood cannot be quantified from the input - the risk rests on the plausible (confirmed by code diff) technical mechanism rather than observed attacks. Net: a genuine but moderate-priority issue, most relevant to services that ingest untrusted ODF files and render the output in a browser.

An attacker crafts a malicious .odt or .ods document in which a style value such as fo:color contains a double-quote followed by an injected event handler (e.g. a value that breaks out of style="..." and adds onerror/onload with JavaScript). When a victim or a server-side pipeline uses odf-kit to convert that document to HTML and the result is displayed in a browser, the injected script executes in the viewer's context. No public exploit code was identified in the provided data, but the patch commit confirms the vulnerable unescaped style="${...}" sinks.