CVE-2026-113787 GitHubNewbie0 CVE debrief

Who should care

Developers and administrators using the odf-kit library in their applications should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 0.14.2 or later of the library and reviewing and sanitizing user-input data used in style attributes.

Why it matters

The CVE-2026-113787 vulnerability in odf-kit allows for HTML injection leading to XSS attacks, impacting applications using affected versions. Defenders should prioritize updating to version 0.14.2 or later and sanitizing user-input data to mitigate this vulnerability.

• Potential for XSS attacks via injected malicious HTML and JavaScript code
• Exposure of sensitive data or unauthorized actions due to successful exploitation
• Reputation damage and loss of user trust if exploited
• Need for urgent patching or mitigation to prevent exploitation

Technical summary

The odf-kit library is vulnerable to HTML injection leading to Cross-Site Scripting (XSS) attacks via unescaped style attribute values in the odtToHtml() function. This issue affects versions from 0.6.0 up to but not including 0.14.2. The vulnerability arises because the library does not properly escape inline CSS strings, specifically style attribute values, which can lead to the injection of malicious HTML and JavaScript code.

Defensive priority

Defenders should prioritize updating to version 0.14.2 or later of the odf-kit library to mitigate this vulnerability. Additionally, reviewing and sanitizing user-input data used in style attributes can help prevent exploitation.

Recommended defensive actions

• Update to version 0.14.2 or later of the odf-kit library
• Review and sanitize user-input data used in style attributes
• Implement Content Security Policy (CSP) to mitigate XSS attacks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the lack of proper escaping of style attribute values in the odtToHtml() function. This allows an attacker to inject malicious HTML and JavaScript code, potentially leading to XSS attacks. The affected versions are from 0.6.0 up to but not including 0.14.2.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.