odf-kit vulnerabilities
CVEs whose affected-version data names the odf-kit package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
GHSA-2rqm-h6hv-g79vMedium· 6.1odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
▾ Sunlitodf-kit · odf-kitvia GHSA
CVE-2026-113787Medium· 6.1odf-kit: HTML injection leading to XSS in odtToHtml() via unescaped style attribute values
odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and JavaScript. Starting in version 0.6.0 and prior to version 0.14.2, he renderer has an `escapeHtml()` helper and applies it…
▾ SunlitGitHubNewbie0 · odf-kitEPSS 0.22%via CVEORG