{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.8.2"}],"component":"phpoffice/phpexcel","cve_ids":["CVE-2024-45292"],"ecosystem":"Packagist","epss":0.00344,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-r8w8-74ww-j4wh","id":"tcs_01M5KF8373A6121ZQC0B2DRY06","modified_at":"2025-03-06T18:37:32.953709Z","published_at":"2024-10-07T15:58:25Z","references":["https://osv.dev/vulnerability/GHSA-r8w8-74ww-j4wh","https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-r8w8-74ww-j4wh","https://nvd.nist.gov/vuln/detail/CVE-2024-45292","https://github.com/PHPOffice/PhpSpreadsheet/commit/392dd08c5569b623060784e1333454d64df1f03d","https://github.com/PHPOffice/PhpSpreadsheet/commit/8b9b378ecdc603234a34aab3b293d2cdc8e9210e","https://github.com/PHPOffice/PhpSpreadsheet/commit/f0b70ed1086348904b27772b264e1605ba6c1d6d","https://github.com/PHPOffice/PhpSpreadsheet"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-r8w8-74ww-j4wh#Packagist/phpoffice/phpexcel","url":"https://osv.dev/vulnerability/GHSA-r8w8-74ww-j4wh"}],"summary":"PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks"}