What is GHSA-r87q-fj25-f8jf?

GHSA-r87q-fj25-f8jf is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx

Which CVE IDs does GHSA-r87q-fj25-f8jf cover?

GHSA-r87q-fj25-f8jf covers the following CVE IDs: CVE-2024-56364. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r87q-fj25-f8jf?

GHSA-r87q-fj25-f8jf has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-r87q-fj25-f8jf?

GHSA-r87q-fj25-f8jf affects 1 product, including: composer/shuchkin/simplexlsx:\u003e= 1.0.12, \u003c 1.1.13.

GHSA-r87q-fj25-f8jfMediumCVSS 6.8

Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx

Vendor

GitHub Security Advisories

Published

December 23, 2024

Last Modified

December 23, 2024

🔗 CVE IDs covered (1)

CVE-2024-56364 →

📋 Description

Impact

When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code.

Patches

The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.13

Workarounds

Don't use data publication via toHTMLEx

This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

🎯 Affected products1

composer/shuchkin/simplexlsx:>= 1.0.12, < 1.1.13

🔗 References (4)

https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-r87q-fj25-f8jf
https://nvd.nist.gov/vuln/detail/CVE-2024-56364
https://github.com/shuchkin/simplexlsx/commit/71a5e3d40d14e33161f8a40b3fd02de542218ef0
https://github.com/advisories/GHSA-r87q-fj25-f8jf