VULNERABILITY INTELLIGENCE

CVE-2024-45292

CVSS score5.4 MEDIUM
EPSS probability0.34%
CISA KEVNot currently listed
Published2024-10-07
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Description

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. `\PhpOffice\PhpSpreadsheet\Writer\Html` does not sanitize "javascript:" URLs from hyperlink `href` attributes, resulting in a Cross-Site Scripting vulnerability. This issue has been addressed in release versions 1.29.2, 2.1.1, and 2.3.0. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness classification

  • security-advisories@github.com: CWE-79

Primary references