{"action":"Upgrade phpoffice/phpspreadsheet to 1.8.0 or later.","affected":[{"fixed":"1.8.0","introduced":"0"}],"component":"phpoffice/phpspreadsheet","cve_ids":["CVE-2019-12331"],"ecosystem":"Packagist","epss":0.0135,"exploited":false,"fixed_versions":["1.8.0"],"ghsa_id":"GHSA-vvwv-h69m-wg6f","id":"tcs_01M5KF9G1CF1AJ3Y515JYTFE8P","modified_at":"2025-03-06T18:09:31.120262Z","published_at":"2019-11-20T01:39:57Z","references":["https://osv.dev/vulnerability/GHSA-vvwv-h69m-wg6f","https://nvd.nist.gov/vuln/detail/CVE-2019-12331","https://github.com/PHPOffice/PhpSpreadsheet/pull/1041","https://github.com/PHPOffice/PhpSpreadsheet/commit/0e6238c69e863b58aeece61e48ea032696c6dccd","https://github.com/FriendsOfPHP/security-advisories/blob/master/phpoffice/phpspreadsheet/CVE-2019-12331.yaml","https://github.com/PHPOffice/PhpSpreadsheet","https://github.com/PHPOffice/PhpSpreadsheet/blob/master/CHANGELOG.md#180---2019-07-01","https://github.com/PHPOffice/PhpSpreadsheet/releases/tag/1.8.0","https://herolab.usd.de/security-advisories/usd-2019-0046"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-vvwv-h69m-wg6f","url":"https://osv.dev/vulnerability/GHSA-vvwv-h69m-wg6f"}],"summary":"XXE in PHPSpreadsheet due to incomplete fix for previous encoding issue"}