Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2024-56412
5.4
MEDIUMCVSS v3
Published
January 3, 2025
Affected
1 project
Assigned by
GitHub
Severity scale
010
Description
PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Versions prior to 3.7.0, 2.3.5, 2.1.6, and 1.29.7 are vulnerable to bypass of the cross-site scripting sanitizer using the javascript protocol and special characters. An attacker can use special characters, so that the library processes the javascript protocol with special characters and generates an HTML link. Versions 3.7.0, 2.3.5, 2.1.6, and 1.29.7 contain a patch for the issue.
PHPOffice/PhpSpreadsheet
GitHubA pure PHP library for reading and writing spreadsheet files
GitHubA pure PHP library for reading and writing spreadsheet files< 1.29.7, >= 2.0.0, < 2.1.6, >= 2.2.0, < 2.3.5, >= 3.0.0, < 3.7.0NVD