Odf Kit
Monthly
Cross-site scripting (CWE-79) in odf-kit 0.10.0 through 0.14.1 lets unauthenticated remote attackers inject HTML or script through crafted ODF style properties such as fo:color, which the ODT-to-HTML renderer concatenates unescaped into style attributes. The issue is exploitable only when a consumer converts an attacker-controlled ODT/ODS document to HTML and then displays that output in a browser or other HTML-rendering context, requiring user interaction (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis, and version 0.14.2 contains the fix.
Cross-site scripting (CWE-79) in odf-kit 0.10.0 through 0.14.1 lets unauthenticated remote attackers inject HTML or script through crafted ODF style properties such as fo:color, which the ODT-to-HTML renderer concatenates unescaped into style attributes. The issue is exploitable only when a consumer converts an attacker-controlled ODT/ODS document to HTML and then displays that output in a browser or other HTML-rendering context, requiring user interaction (CVSS 6.1, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No public exploit code was identified at time of analysis, and version 0.14.2 contains the fix.