{"action":"Upgrade phpoffice/phpspreadsheet to 1.29.8 or later.","affected":[{"fixed":"3.8.0","introduced":"3.0.0"},{"fixed":"1.29.8","introduced":"0"},{"fixed":"2.1.7","introduced":"2.0.0"},{"fixed":"2.3.6","introduced":"2.2.0"}],"component":"phpoffice/phpspreadsheet","cve_ids":["CVE-2025-22131"],"ecosystem":"Packagist","epss":0.00401,"exploited":false,"fixed_versions":["3.8.0","1.29.8","2.1.7","2.3.6"],"ghsa_id":"GHSA-79xx-vf93-p7cx","id":"tcs_01M5KEXXEYFG7QRW7NX4MBHZGV","modified_at":"2025-03-06T18:37:31.054095Z","published_at":"2025-01-21T21:09:13Z","references":["https://osv.dev/vulnerability/GHSA-79xx-vf93-p7cx","https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-79xx-vf93-p7cx","https://nvd.nist.gov/vuln/detail/CVE-2025-22131","https://github.com/PHPOffice/PhpSpreadsheet/commit/4088381ccfaf241d7d42c333de0dc8c98e338743","https://github.com/PHPOffice/PhpSpreadsheet"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-79xx-vf93-p7cx","url":"https://osv.dev/vulnerability/GHSA-79xx-vf93-p7cx"}],"summary":"Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet"}