What’s Vulnerable › Vulnerabilities

CVE-2024-55878: Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-12-12 · updated 2026-06-17
• Weakness: CWE-79

Description

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.

Affected products

• shuchkin simplexlsx: from 1.0.12, < 1.1.12

References

• https://github.com/shuchkin/simplexlsx/commit/cb4e716259e83d18e89292a4f1b721f4d34e28c2
• https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-x6mh-rjwm-8ph7

Get alerted when CVE-2024-55878 or the next vulnerability affects your stack