solspace/craft-freeform Vulnerable to XSS in PhpSpreadsheet HTML Writer Due to Unsanitized Styling Data

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS 4.0

1.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P · score source

EPSS

No dated EPSS signal available.

As published by the source; long descriptions are shortened.

Summary Short summary of the problem. Make the impact and severity as clear as possible. For example: An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server. \PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. See https://github.com/advisories/GHSA-wgmf-q9vr-vww6 PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Example target script: Save this file in the same directory: book.xlsx Open index.php in a web browser. An alert should be displayed. Impact What kind of vulnerability is it? Who is impacted? Full takeover of the session of users viewing spreadsheet files as HTML.

Published by the source

15 Jan 2026, 22:40 UTC

Last modified by the source

15 Jan 2026, 22:40 UTC

Source last checked

26 Oct 2026, 14:35 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-44jg-mv3h-wj6g

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: GHSA-44jg-mv3h-wj6g

Advisory: solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
IDs: GHSA-44jg-mv3h-wj6g
Record: https://patchnext.com/advisories/ghsa-44jg-mv3h-wj6g (revision 1, source checked 26 Oct 2026, 14:35 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Low (CVSS 1.9)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: solspace/craft-freeform 4.1.23. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist solspace/craft-freeform: affected < 4.1.23; fixed in 4.1.23

## Suggested inspection (read-only)
- Packagist solspace/craft-freeform: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on solspace/craft-freeform.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-44jg-mv3h-wj6g (GitHub-reviewed advisory GHSA-44jg-mv3h-wj6g lists affected ranges: Packagist solspace/craft-freeform >=0 <4.1.23)

Commands are suggestions: review each one before running it.