Cross-Site Scripting Vulnerability in ODF-Kit by GitHubNewbie0
CVE-2026-113787

6.1MEDIUM

Key Information:

Vendor

Githubnewbie0

Status
Odf-kit
Vendor
CVE Published:
21 October 2026

What is CVE-2026-113787?

The ODF-Kit, a tool for generating and manipulating OpenDocument Format files, has a vulnerability that affects versions 0.10.0 to 0.14.1. This flaw occurs when unescaped inline CSS styles are rendered directly into HTML attributes, allowing attackers to inject malicious content. Specifically, inline styles such as fo:color, fo:background-color, and others can terminate attributes prematurely, leading to unintended behavior and potential XSS attacks. Version 0.14.2 includes a patch that addresses this issue.

Affected Version(s)

odf-kit >= 0.10.0, < 0.14.2

References

https://github.com/GitHubNewbie0/odf-kit/security/advisor...
x_refsource_CONFIRM
https://github.com/GitHubNewbie0/odf-kit/commit/fa3abc5a7...
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.