{"id":"CVE-2024-55878","aliases":["EUVD-2024-3522","GHSA-x6mh-rjwm-8ph7"],"status":"published","title":"Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx","description":"SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00459,"percentile":0.4003,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-12-12T19:20:02Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"Packagist","package":"shuchkin/simplexlsx","fixed_in":["1.1.12"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"shuchkin/simplexlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.12"},{"fixed":"1.1.12"}]}]},{"source":"osv","ecosystem":"Packagist","package":"shuchkin/simplexlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.12"},{"fixed":"1.1.12"}]}],"versions":["1.0.12","1.0.13","1.0.14","1.0.15","1.0.16","1.0.17","1.0.18","1.0.19","1.0.20","1.0.21","1.1.10","1.1.11"]}],"products":[{"vendor":"shuchkin","product":"simplexlsx"}],"references":[{"url":"https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-x6mh-rjwm-8ph7","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/shuchkin/simplexlsx/commit/cb4e716259e83d18e89292a4f1b721f4d34e28c2","tags":["x_refsource_MISC","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55878","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-x6mh-rjwm-8ph7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55878.json","tags":["advisory"]},{"url":"https://github.com/shuchkin/simplexlsx","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-55878","title":"Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx","description":"SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.","status":"published","published":"2024-12-12T19:20:02.061Z","modified":"2024-12-13T15:57:54.961Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:22.153872Z"}],"euvd":[{"id":"EUVD-2024-3522","description":"SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.","status":"published","published":"2024-12-12T19:20:02Z","modified":"2024-12-13T15:57:54Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:35.519932Z"}],"ghsa":[{"id":"GHSA-x6mh-rjwm-8ph7","title":"Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx","description":"### Impact\nWhen calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code.\n\n### Patches\nThe supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.12\n\n### Workarounds\nDon't use direct publication via toHTMLEx\n\n***\nThis vulnerability was discovered by Aleksey Solovev (Positive Technologies)\n","status":"published","published":"2024-12-12T19:22:53Z","modified":"2024-12-12T22:31:59Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:38:25.334027Z"}],"nvd":[{"id":"CVE-2024-55878","description":"SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.","status":"published","published":"2024-12-12T20:15:21.493Z","modified":"2026-06-17T08:11:23.89Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:10:40.137849Z"}],"osv":[{"id":"CVE-2024-55878","title":"Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx","description":"SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.","status":"published","published":"2024-12-12T19:20:02.061Z","modified":"2026-10-28T02:31:06.726654392Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"GHSA-x6mh-rjwm-8ph7","title":"Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx","description":"### Impact\nWhen calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code.\n\n### Patches\nThe supplied patch resolves this vulnerability for SimpleXLSX. Use 1.1.12\n\n### Workarounds\nDon't use direct publication via toHTMLEx\n\n***\nThis vulnerability was discovered by Aleksey Solovev (Positive Technologies)\n","status":"published","published":"2024-12-12T19:22:53Z","modified":"2024-12-12T22:38:33.943623Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:59.484835Z"}]}}