CVE-2026-113787 with a CVSS score of 6.1 is a cross-site scripting vulnerability in odf-kit (npm) versions >= 0.6.0, < 0.14.2, caused by HTML injection in the odtToHtml() and odsToHtml() renderers. The flaw occurs because ODF style attribute values are copied into inline style attributes without HTML escaping, so a double-quote character in an attacker-controlled value can terminate the attribute and inject arbitrary markup or attributes. An attacker can exploit it by supplying a crafted .odt or .ods file to an application or user that converts the file and inserts the resulting HTML into a web page. The attack requires no privileges and low complexity, but does require user interaction because the malicious document must be processed and the rendered output must be displayed in a browser context. Successful exploitation allows script execution in the host page with the page origin, enabling session hijacking, credential theft, unauthorized actions, data manipulation, or defacement. Because the affected functions are documented for producing HTML, consumers may reasonably embed the output, increasing the likelihood that untrusted documents reach a vulnerable rendering path and create a meaningful business risk.
We recommend you to update odf-kit to version 0.14.2.[/subscribe_to_unlock_form]
CVE-2026-113787 with a CVSS score of 6.1 is a cross-site scripting vulnerability in odf-kit (npm) versions >= 0.6.0, < 0.14.2, caused by HTML injection in the odtToHtml() and odsToHtml() renderers. The flaw occurs because ODF style attribute values are copied into inline style attributes without HTML escaping, so a double-quote character in an attacker-controlled value can terminate the attribute and inject arbitrary markup or attributes. An attacker can exploit it by supplying a crafted .odt or .ods file to an application or user that converts the file and inserts the resulting HTML into a web page. The attack requires no privileges and low complexity, but does require user interaction because the malicious document must be processed and the rendered output must be displayed in a browser context. Successful exploitation allows script execution in the host page with the page origin, enabling session hijacking, credential theft, unauthorized actions, data manipulation, or defacement. Because the affected functions are documented for producing HTML, consumers may reasonably embed the output, increasing the likelihood that untrusted documents reach a vulnerable rendering path and create a meaningful business risk.
We recommend you to update odf-kit to version 0.14.2.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]