Live › vulnerability › CVE-2026-113787
Go to dashboardodf-kit's ODT-to-HTML renderer escapes text and most attributes but copies style values such as fo:color and fo:font-family into inline style attributes without escaping. A crafted document with a double quote in one of these values can break out of the attribute and inject HTML.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that use odf-kit's ODT-to-HTML rendering on OpenDocument files from users or external sources are exposed, since the injected markup comes from the document's own style properties. Projects that only generate or fill ODF files, or that never render to HTML, are not affected by this flaw. Teams that render only their own trusted documents face much lower risk.
No product ranges from the sources yet.
npm ls odf-kit to find the installed version and any projects depending on it.odf-kit that call the HTML renderer on documents from users or other untrusted sources.odf-kit to 0.14.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml() helper and applies it consistently to text content and to attribute values — href, src, alt, id, data-author, data-date, citation text all go through it. The inline CSS strings do not. In renderTextSpan (dist/odt/to-html/html-renderer.js:195), the value of e.g. fo:color is copied from the document into style.fontColor verbatim by the parser (extractSpanStyle, read/parser.js:348), then concatenated raw into the attribute. A " in the value terminates the attribute early. The same unescaped style="${...}" pattern appears at roughly ten other emission sites: paragraph and heading (paragraphStyleToCss), table cells and rows (cellStyleToCss, rowStyleToCss), <col>, and the image style attribute. The affected source attributes include fo:color, fo:background-color, fo:text-shadow, fo:letter-spacing, fo:font-family (via both direct and font-face resolution), fo:margin-*, fo:padding-*, fo:line-height, fo:border*, and style:vertical-align. Version 0.14.2 contains a patch.
This page as .md · .json · in your agent: get_signal("CVE-2026-113787")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.