---
id: "CVE-2026-113787"
kind: "vulnerability"
aliases: ["CVE-2026-113787"]
title: "odf-kit: unescaped CSS values in HTML output allow attribute injection"
severity: "medium"
cvss: 6.1
epss: 0.00206
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["document-processing", "node", "odf-kit", "package", "typescript"]
not_affected_if: ["no-html-rendering", "trusted-documents-only"]
published_at: "2026-10-21T16:17:26+00:00"
first_seen_at: "2026-10-23T21:57:29+00:00"
updated_at: "2026-10-25T04:03:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113787", "first_seen_at": "2026-10-23T21:57:29+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-113787", "first_seen_at": "2026-10-24T13:15:54+00:00"}]
---

# odf-kit: unescaped CSS values in HTML output allow attribute injection

odf-kit's ODT-to-HTML renderer escapes text and most attributes but copies style values such as fo:color and fo:font-family into inline style attributes without escaping. A crafted document with a double quote in one of these values can break out of the attribute and inject HTML.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `npm ls odf-kit` to find the installed version and any projects depending on it.
- Search your code for imports of `odf-kit` that call the HTML renderer on documents from users or other untrusted sources.

## Fix

- Upgrade `odf-kit` to `0.14.2` or later.
- Until upgraded, do not render untrusted .odt files to HTML, or sanitize the generated HTML before inserting it into a page.

## Timeline

- 2026-10-23T21:57:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113787
- 2026-10-24T13:15:54+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-113787

## From the sources

odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`, `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not. In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`, `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vertical-align`. Version 0.14.2 contains a patch.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_