GHSA-44jg-mv3h-wj6g
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
GHSA-44jg-mv3h-wj6g is a low vulnerability (CVSS 1.9) in solspace/craft-freeform, published January 15, 2026. No source lists public exploit code. Fixed in solspace/craft-freeform 4.1.23.
- Severity
- 1.9 LowCVSS 4.0, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.1.23solspace/craft-freeform +1 more
Description
Summary
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
\PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.
Details
Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.
See https://github.com/advisories/GHSA-wgmf-q9vr-vww6
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Example target script:
<?php
require 'vendor/autoload.php';
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');
$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
print($writer->generateHTMLAll());
Save this file in the same directory:
Open index.php in a web browser. An alert should be displayed.
Impact
What kind of vulnerability is it? Who is impacted?
Full takeover of the session of users viewing spreadsheet files as HTML.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
solspace/craft-freeformPackagist | before 4.1.23 | 4.1.23 |
solspace/craft-freeformPackagist | before 4.1.23, plus listed versions 2.0.02.0.0-beta.12.0.0-beta.102.0.0-beta.112.0.0-beta.12 Show 45 moreShow less2.0.0-beta.132.0.0-beta.142.0.0-beta.152.0.0-beta.162.0.0-beta.172.0.0-beta.182.0.0-beta.192.0.0-beta.22.0.0-beta.202.0.0-beta.32.0.0-beta.42.0.0-beta.52.0.0-beta.62.0.0-beta.72.0.0-beta.82.0.0-beta.92.0.12.0.22.0.32.0.42.1.02.1.12.2.02.2.12.2.22.3.02.3.12.3.22.3.32.3.42.4.02.4.12.4.22.4.32.5.02.5.12.5.102.5.112.5.122.5.132.5.142.5.152.5.162.5.172.5.18 | 4.1.23 |
What each source reports
GitHub Advisories Score used
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
Summary
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
\PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.
Details
Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.
See https://github.com/advisories/GHSA-wgmf-q9vr-vww6
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Example target script:
<?php
require 'vendor/autoload.php';
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');
$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
print($writer->generateHTMLAll());
Save this file in the same directory:
Open index.php in a web browser. An alert should be displayed.
Impact
What kind of vulnerability is it? Who is impacted?
Full takeover of the session of users viewing spreadsheet files as HTML.
- Record
GHSA-44jg-mv3h-wj6g- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
Summary
Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server.
\PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page.
Details
Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer.
See https://github.com/advisories/GHSA-wgmf-q9vr-vww6
PoC
Complete instructions, including specific configuration details, to reproduce the vulnerability.
Example target script:
<?php
require 'vendor/autoload.php';
$reader = \PhpOffice\PhpSpreadsheet\IOFactory::createReader("Xlsx");
$spreadsheet = $reader->load(__DIR__ . '/book.xlsx');
$writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet);
print($writer->generateHTMLAll());
Save this file in the same directory:
Open index.php in a web browser. An alert should be displayed.
Impact
What kind of vulnerability is it? Who is impacted?
Full takeover of the session of users viewing spreadsheet files as HTML.
- Record
GHSA-44jg-mv3h-wj6g- CVSS 4.0
- 1.9 Low
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
Left out here: 264 versions. The JSON record has them.