medium6.8
CVE-2024-55878
Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx
Impact
### Impact When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. ### Patches The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.12 ### Workarounds Don't use direct publication via toHTMLEx *** This vulnerability was discovered by Aleksey Solovev (Positive Technologies)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | shuchkin/simplexlsx | >= 1.0.12, < 1.1.12 | 1.1.12 |