-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from unsanitized font name input in style generation. The commit diff shows the fix added htmlspecialchars() to sanitize font names in createCSSStyleFont. Prior to this fix, a font name like 'Calibri</style><script>alert(1)</script>' would inject executable JavaScript into the HTML output. The test case 'testXssInFontName' in XssVulnerabilityTest.php demonstrates this attack vector, and the patch specifically addresses it by escaping font names.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpoffice/phpspreadsheet | composer | >= 2.0.0, < 2.1.0 | 2.1.0 |
| phpoffice/phpspreadsheet | composer | < 1.29.1 | 1.29.1 |
| phpoffice/phpexcel | composer | <= 1.8.2 |
Ongoing coverage of React2Shell