Arbitrary JavaScript Code Execution Vulnerability in SimpleXLSX
CVE-2024-55878

6.8MEDIUM

Key Information:

Vendor

Shuchkin

Status
Simplexlsx
Vendor
CVE Published:
12 December 2024

What is CVE-2024-55878?

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.

Affected Version(s)

simplexlsx >= 1.0.12, < 1.1.12

References

https://github.com/shuchkin/simplexlsx/security/advisorie...
x_refsource_CONFIRM
https://github.com/shuchkin/simplexlsx/commit/cb4e716259e...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.