What is GHSA-x6mh-rjwm-8ph7?

GHSA-x6mh-rjwm-8ph7 is a security advisory published by GitHub Security Advisories with Medium severity. Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

Which CVE IDs does GHSA-x6mh-rjwm-8ph7 cover?

GHSA-x6mh-rjwm-8ph7 covers the following CVE IDs: CVE-2024-55878. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x6mh-rjwm-8ph7?

GHSA-x6mh-rjwm-8ph7 has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

Which products are affected by GHSA-x6mh-rjwm-8ph7?

GHSA-x6mh-rjwm-8ph7 affects 1 product, including: composer/shuchkin/simplexlsx:\u003e= 1.0.12, \u003c 1.1.12.

GHSA-x6mh-rjwm-8ph7MediumCVSS 6.8

Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

Vendor

GitHub Security Advisories

Published

December 12, 2024

Last Modified

December 12, 2024

🔗 CVE IDs covered (1)

CVE-2024-55878 →

📋 Description

Impact

When calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code.

Patches

The supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.12

Workarounds

Don't use direct publication via toHTMLEx

This vulnerability was discovered by Aleksey Solovev (Positive Technologies)

🎯 Affected products1

composer/shuchkin/simplexlsx:>= 1.0.12, < 1.1.12

🔗 References (4)

https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-x6mh-rjwm-8ph7
https://github.com/shuchkin/simplexlsx/commit/cb4e716259e83d18e89292a4f1b721f4d34e28c2
https://nvd.nist.gov/vuln/detail/CVE-2024-55878
https://github.com/advisories/GHSA-x6mh-rjwm-8ph7