medium6.8
CVE-2024-56364
Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx
Impact
### Impact When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. ### Patches The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.13 ### Workarounds Don't use data publication via toHTMLEx *** This vulnerability was discovered by Aleksey Solovev (Positive Technologies)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | shuchkin/simplexlsx | >= 1.0.12, < 1.1.13 | 1.1.13 |