odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values

Overview

Summary

ODF style values are interpolated into style="..." attributes without HTML-escaping in odf-kit's ODS to-HTML renderer (odsToHtml()). A double-quote character inside an attacker-controlled style value breaks out of the attribute, allowing arbitrary HTML/attribute injection — and therefore script execution (XSS) — from a crafted .ods file wherever the rendered output is inserted as HTML, which is the documented purpose of the function.

Details

Two emission sites in src/ods/to-html/html-renderer.ts (before 0.14.0, src/ods-reader/html-renderer.ts) write document-controlled values into a style attribute without escaping:

• Cell style. buildInlineStyle() assembles a CSS string from the cell's formatting properties (fo:color, fo:font-size, fo:font-family, fo:background-color, fo:text-align, etc.) with no escaping, and renderCell emits it raw as the cell's style attribute.
• Row height. row.height (from style:row-height) is emitted raw into the row element's style attribute.

The same defect in the ODT renderer (odtToHtml()) is tracked as GHSA-3cgg-c5pp-57h6 (CVE-2026-113787).

Impact

Any consumer that renders odsToHtml() output as HTML gets XSS from a crafted .ods file they convert: untrusted file → arbitrary tags and attributes → script execution in the host page with the page's origin.

Patches

Fixed in 0.14.2. Both sites now route document-controlled values through a shared attribute-escaping helper:

• 1424227: escape style attribute values in the ODS HTML renderer
• aa64c73: the shared escapeAttr helper

Users should upgrade to 0.14.2 or later.

Credit

Reported by @PethuKannan.

Affected packages

• odf-kit >= 0.9.8, < 0.14.2

Remediation

Upgrade to a patched release:

• odf-kit 0.14.2