{"action":"Upgrade odf-kit to 0.14.2 or later.","affected":[{"fixed":"0.14.2","introduced":"0.9.8"}],"component":"odf-kit","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.14.2"],"ghsa_id":"GHSA-2rqm-h6hv-g79v","id":"tcs_01M5NASTTDCDT6TWK0AHA28PAY","modified_at":"2026-10-23T21:00:05.237565089Z","published_at":"2026-10-23T20:55:31Z","references":["https://osv.dev/vulnerability/GHSA-2rqm-h6hv-g79v","https://github.com/GitHubNewbie0/odf-kit/security/advisories/GHSA-2rqm-h6hv-g79v","https://github.com/GitHubNewbie0/odf-kit/commit/1424227d1ca2716a249b623d1456575ff0331dcc","https://github.com/GitHubNewbie0/odf-kit"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-2rqm-h6hv-g79v","url":"https://osv.dev/vulnerability/GHSA-2rqm-h6hv-g79v"}],"summary":"odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values"}