MEDIUM6.4
GHSA-4mqv-gcr3-pff9
Cross-site scripting in phpoffice/phpspreadsheet
Quick fix
GHSA-4mqv-gcr3-pff9 — phpoffice/phpspreadsheet: upgrade to the fixed version with the command below.
composer require phpoffice/phpspreadsheet:^1.16.0Details
This affects the package phpoffice/phpspreadsheet. The library is vulnerable to XSS when creating an html output from an excel file by adding a comment on any cell. The root cause of this issue is within the HTML writer where user comments are concatenated as part of link and this is returned as HTML.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/phpoffice/phpspreadsheet
Introduced in:
0Fixed in: 1.16.0Fix
composer require phpoffice/phpspreadsheet:^1.16.0Packagist/phpoffice/phpexcel
Introduced in:
0No fixed version published yet for phpoffice/phpexcel (composer). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-7776[ADVISORY]
- https://github.com/PHPOffice/PhpSpreadsheet/pull/1719[WEB]
- https://github.com/PHPOffice/PhpSpreadsheet/commit/0ed5b800be2136bcb8fa9c1bdf59abc957a98845[WEB]
- https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2020-7776.yaml[WEB]
- https://github.com/PHPOffice/PhpSpreadsheet/blob/master/src/PhpSpreadsheet/Writer/Html.php%23L1792[WEB]
- https://snyk.io/vuln/SNYK-PHP-PHPOFFICEPHPSPREADSHEET-1048856[WEB]