GitHubNewbie0 odf-kit vulnerabilities

Latest GitHubNewbie0 odf-kit CVEs

Newest publication first

1. CVE-2026-113787 odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values

   Published 2026-10-21

   Medium·CVSS 6.1 EPSS 0.25%

   odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an escapeHtml() helper and applies it consistently to text content and to attribut...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.