{"action":"Upgrade phpoffice/phpspreadsheet to 1.29.2 or later.","affected":[{"fixed":"2.3.0","introduced":"2.2.0"},{"fixed":"1.29.2","introduced":"0"},{"fixed":"2.1.1","introduced":"2.0.0"}],"component":"phpoffice/phpspreadsheet","cve_ids":["CVE-2024-45292"],"ecosystem":"Packagist","epss":0.00344,"exploited":false,"fixed_versions":["2.3.0","1.29.2","2.1.1"],"ghsa_id":"GHSA-r8w8-74ww-j4wh","id":"tcs_01M5KF834KWGB3XBV2FGCC7CHC","modified_at":"2025-03-06T18:37:32.953709Z","published_at":"2024-10-07T15:58:25Z","references":["https://osv.dev/vulnerability/GHSA-r8w8-74ww-j4wh","https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh","https://nvd.nist.gov/vuln/detail/CVE-2024-45292","https://github.com/PHPOffice/PhpSpreadsheet/commit/392dd08c5569b623060784e1333454d64df1f03d","https://github.com/PHPOffice/PhpSpreadsheet/commit/8b9b378ecdc603234a34aab3b293d2cdc8e9210e","https://github.com/PHPOffice/PhpSpreadsheet/commit/f0b70ed1086348904b27772b264e1605ba6c1d6d","https://github.com/PHPOffice/PhpSpreadsheet"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-r8w8-74ww-j4wh","url":"https://osv.dev/vulnerability/GHSA-r8w8-74ww-j4wh"}],"summary":"PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks"}