VulnerabilityDeferred

CVE-2024-56364

Starting in 1.0.12 and ending in 1.1.13, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code.

MEDIUM 5.4EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in 1.0.12 and ending in 1.1.13, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. This vulnerability is fixed in 1.1.13.

CVSS 3.1: 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.25% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: security-advisories@github.com

References

https://github.com/shuchkin/simplexlsx/commit/71a5e3d40d14e33161f8a40b3fd02de542218ef0
https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-r87q-fj25-f8jf

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.