GHSA-r8w8-74ww-j4wh PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks

• Packagist phpoffice/phpspreadsheet: >= 2.2.0, < 2.3.0 → fixed in 2.3.0 • Packagist phpoffice/phpspreadsheet: < 1.29.2 → fixed in 1.29.2 • Packagist phpoffice/phpspreadsheet: >= 2.0.0, < 2.1.1 → fixed in 2.1.1 • Packagist phpoffice/phpexcel: <= 1.8.2 (no fix yet)

Summary `\PhpOffice\PhpSpreadsheet\Writer\Html` does not sanitize "javascript:" URLs from hyperlink `href` attributes, resulting in a Cross-Site Scripting vulnerability. PoC Example target script: ``` load(__DIR__ . '/book.xlsx'); $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); print($writer->generateHTMLAll()); ``` Save this file in the same directory: book.xlsx Open index.php in a web browser and click on both links. The first demonstrates the vulnerability in a regular hyperlink and the second in a HYPERLINK() formula.