odf-kit vulnerabilities

CVEs whose affected-version data names the odf-kit package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-113787Medium· 6.1

today

odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.10.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies i…

▾ SunlitGitHubNewbie0 · odf-kitvia CVEORG