{"action":"Upgrade phpoffice/phpspreadsheet to 1.29.2 or later.","affected":[{"fixed":"2.3.0","introduced":"2.2.0"},{"fixed":"1.29.2","introduced":"0"},{"fixed":"2.1.1","introduced":"2.0.0"}],"component":"phpoffice/phpspreadsheet","cve_ids":["CVE-2024-45060"],"ecosystem":"Packagist","epss":0.00507,"exploited":false,"fixed_versions":["2.3.0","1.29.2","2.1.1"],"ghsa_id":"GHSA-v66g-p9x6-v98p","id":"tcs_01M5KF8VNA4JGMTN0DQBA1PZF3","modified_at":"2025-03-06T18:37:14.920918Z","published_at":"2024-10-07T14:43:30Z","references":["https://osv.dev/vulnerability/GHSA-v66g-p9x6-v98p","https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-v66g-p9x6-v98p","https://nvd.nist.gov/vuln/detail/CVE-2024-45060","https://github.com/PHPOffice/PhpSpreadsheet/commit/3990173db1207767139e63d33783beafada57007","https://github.com/PHPOffice/PhpSpreadsheet/commit/bc74f3aa1d76f191c6c7c3631e286abb25c38759","https://github.com/PHPOffice/PhpSpreadsheet/commit/fb42a103f14cfce258c836b31f4a71f1fb1a9747","https://github.com/PHPOffice/PhpSpreadsheet","https://github.com/PHPOffice/PhpSpreadsheet/blob/d50b8b5de7e30439fb57eae7df9ea90e79fa0f2d/samples/Basic/45_Quadratic_equation_solver.php#L56"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-v66g-p9x6-v98p","url":"https://osv.dev/vulnerability/GHSA-v66g-p9x6-v98p"}],"summary":"PhpSpreadsheet has an Unauthenticated Cross-Site-Scripting (XSS) in sample file"}