CVE-2024-55878

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in version 1.0.12 and prior to version 1.1.12, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. Version 1.1.12 fixes the issue. As a workaround, don't use direct publication via toHTMLEx.

• CWE-79

• https://github.com/shuchkin/simplexlsx/commit/cb4e716259e83d18e89292a4f1b721f4d34e28c2
• https://github.com/shuchkin/simplexlsx/security/advisories/GHSA-x6mh-rjwm-8ph7

Published

Dec 12, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5586Zohocorp ManageEngine ADAudit Plus versions below 8121 are v…8.8
• CVE-2024-55864Cross-site scripting vulnerability exists in My WP Customize…4.8
• CVE-2024-5587A vulnerability was found in Casdoor up to 1.335.0. It has b…6.9
• CVE-2024-55875http4k is a functional toolkit for Kotlin HTTP applications.…9.8
• CVE-2024-55876XWiki Platform is a generic wiki platform. Starting in versi…5.4
• CVE-2024-55877XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-55879XWiki Platform is a generic wiki platform. Starting in versi…8.8
• CVE-2024-5588A vulnerability was found in itsourcecode Learning Managemen…8.8
• CVE-2024-55881In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-55884In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), an…9
• CVE-2024-55885beego is an open-source web framework for the Go programming…7.5
• CVE-2024-55886OpenSearch Data Prepper is a component of the OpenSearch pro…6.9