Packagist/phpoffice/phpexcel CVE-2024-45292: medium 5.4, EPSS 0.34%

PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-r8w8-74ww-j4wh#Packagist/phpoffice/phpexcel
• https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh
• https://nvd.nist.gov/vuln/detail/CVE-2024-45292
• https://github.com/PHPOffice/PhpSpreadsheet/commit/392dd08c5569b623060784e1333454d64df1f03d
• https://github.com/PHPOffice/PhpSpreadsheet/commit/8b9b378ecdc603234a34aab3b293d2cdc8e9210e
• https://github.com/PHPOffice/PhpSpreadsheet/commit/f0b70ed1086348904b27772b264e1605ba6c1d6d
• https://github.com/PHPOffice/PhpSpreadsheet

CVE-2024-45292 · published 2024-10-07T15:58:25Z · modified 2025-03-06T18:37:32.953709Z · JSON