CVE-2025-23210: PhpSpreadsheet XSS Sanitizer Bypass via JavaScript Protocol
Summary
CVE-2025-23210: PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters. Affects phpoffice/phpspreadsheet across 4 version ranges.
< 1.29.9
>= 2.0.0, < 2.1.8
>= 2.2.0, < 2.3.7
>= 3.0.0, < 3.9.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PhpSpreadsheet is a popular open-source library for reading and writing spreadsheet files in various formats, including Excel. It allows developers to create, modify, and read spreadsheet documents programmatically. However, the library has a vulnerability that allows attackers to bypass the XSS sanitizer, potentially leading to the execution of arbitrary JavaScript code in users' browsers.
Vulnerability Detail
The vulnerability arises from the improper neutralization of input during web page generation, specifically in the generateRow method of the PhpOffice\PhpSpreadsheet\Writer\Html class. An attacker can exploit this by crafting a specially formatted XML file that includes special characters before the JavaScript protocol. This manipulation allows the library to generate an HTML link that executes embedded JavaScript when clicked, leading to potential security risks such as data theft or unauthorized actions on behalf of the user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.29.91.29.9composer require phpoffice/phpspreadsheet:1.29.9 -
>= 2.0.0, < 2.1.82.1.8composer require phpoffice/phpspreadsheet:2.1.8 -
>= 2.2.0, < 2.3.72.3.7composer require phpoffice/phpspreadsheet:2.3.7 -
>= 3.0.0, < 3.9.03.9.0composer require phpoffice/phpspreadsheet:3.9.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement additional sanitization of special characters in the input strings before processing them with PhpSpreadsheet. This can help mitigate the risk of XSS attacks until the library is updated.
Conclusion
The CVE-2025-23210 vulnerability in PhpSpreadsheet allows attackers to bypass XSS sanitization, leading to potential execution of malicious JavaScript in users' browsers. It is crucial to update to the latest patched versions of the library to mitigate this risk. Additionally, implementing input sanitization can provide a temporary solution until an update is applied.
See every vulnerability recorded for phpoffice/phpspreadsheet →
FAQ
The CVSS score of this vulnerability is 5.4, indicating a moderate level of risk.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The potential impacts include the execution of arbitrary JavaScript code in the user's browser, which could lead to data theft, session hijacking, or other malicious activities.
Yes, implementing additional sanitization of special characters in input strings can help mitigate the risk until you can update to a secure version.
The vulnerability was discovered by Igor Sak-Sakovskiy from Positive Technologies.
References
Related vulnerabilities
Recent vulnerabilities recorded for phpoffice/phpspreadsheet.
