Detections
Analytics

SCA: security update for odf-kit (GHSA-3cgg-c5pp-57h6)

medium Tenable Self-Hosted Container Security Plugin ID 478342

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in
 TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an
 `escapeHtml()` helper and applies it consistently to text content and to attribute values — `href`, `src`,
 `alt`, `id`, `data-author`, `data-date`, citation text all go through it. The inline CSS strings do not.
 In `renderTextSpan` (`dist/odt/to-html/html-renderer.js:195`), the value of e.g. `fo:color` is copied from
 the document into `style.fontColor` verbatim by the parser (`extractSpanStyle`, read/parser.js:348), then
 concatenated raw into the attribute. A `"` in the value terminates the attribute early. The same unescaped
 `style="${...}"` pattern appears at roughly ten other emission sites: paragraph and heading
 (`paragraphStyleToCss`), table cells and rows (`cellStyleToCss`, `rowStyleToCss`), `<col>`, and the image
 style attribute. The affected source attributes include `fo:color`, `fo:background-color`, `fo:text-
 shadow`, `fo:letter-spacing`, `fo:font-family` (via both direct and font-face resolution), `fo:margin-*`,
 `fo:padding-*`, `fo:line-height`, `fo:border*`, and `style:vertical-align`. Version 0.14.2 contains a
 patch. (CVE-2026-113787)

Solution

Update the odf-kit library and its related packages to version 0.14.2 or later.

See Also

https://github.com/advisories/GHSA-3cgg-c5pp-57h6

Plugin Details

Severity: Medium

ID: 478342

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 11/4/2026

Updated: 11/4/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 10.26

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2026-113787

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 11/4/2026

Vulnerability Publication Date: 10/21/2026

Reference Information

CVE: CVE-2026-113787

cwe: CWE-79