Executive brief
x-data-spreadsheet is a popular JavaScript library that provides a spreadsheet UI component for web applications. A vulnerability in versions through 1.1.9 allows attackers to inject malicious scripts into spreadsheet cells, which are then executed in the browsers of users viewing the spreadsheet. This could allow attackers to steal user credentials, hijack sessions, or perform unauthorized actions on behalf of users.
Technical details
The vulnerability is a Stored Cross-site Scripting (XSS) flaw (CWE-79) in x-data-spreadsheet versions through 1.1.9, caused by missing input sanitization on values inserted into spreadsheet cells. An attacker can inject malicious HTML/JavaScript payloads (e.g., "<img src=1 onerror=alert(document.domain)>") directly into cells, which are then rendered without sanitization when the spreadsheet is displayed. The attack requires no authentication and only requires user interaction (opening a spreadsheet containing malicious content). When a user views the affected spreadsheet in a browser, the injected script executes in the context of the user's session, potentially allowing session hijacking, credential theft, or DOM manipulation. No patch information is provided in the advisory.
Affected products
- myliang x-data-spreadsheet through 1.1.9
Timeline
- 2022-08-31: disclosed
- 2022-03-18: other: XSS vulnerability reported on GitHub issue #580