GHSA-wgmf-q9vr-vww6 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

• Packagist phpoffice/phpspreadsheet: >= 2.0.0, < 2.1.0 → fixed in 2.1.0 • Packagist phpoffice/phpspreadsheet: < 1.29.1 → fixed in 1.29.1 • Packagist phpoffice/phpexcel: <= 1.8.2 (no fix yet)

Summary `\PhpOffice\PhpSpreadsheet\Writer\Html` doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. PoC Example target script: ``` load(__DIR__ . '/book.xlsx'); $writer = new \PhpOffice\PhpSpreadsheet\Writer\Html($spreadsheet); print($writer->generateHTMLAll()); ``` Save this file in the same directory: book.xlsx Open index.php in a web browser. An alert should be displayed. Impact Full takeover of the session of users viewing spreadsheet files as HTML.