The odf-kit library, used for handling OpenDocument files, contains an issue where inline CSS styles are inserted into HTML without proper escaping. Because style attribute values such as fo:color, fo:background-color, and many others are copied verbatim, an attacker can embed a quotation mark or script into these attributes, causing the rendered HTML to execute arbitrary JavaScript. The vulnerability can lead to defacement, cookie theft, and other attacks that rely on XSS when a user opens a malicious ODT file that is rendered to the web.

The vulnerability affects GitHubNewbie0:odf-kit versions 0.10.0 through 0.14.1. Any project or application that imports odf-kit within this range and renders ODT documents into HTML is potentially exposed. Version 0.14.2 and later contain a fix that properly escapes style attributes.

The CVSS score of 6.1 indicates a moderate impact. The EPSS score is not available, and the flaw is not currently listed in the CISA KEV catalog. An attacker would need to supply a crafted ODT file that includes a malicious style value, which is then parsed and rendered by the vulnerable library. If the ODT is displayed in a trusted web context, the XSS can be executed in the victim's browser, giving the attacker whatever privileges the victim has. The risk is higher for applications that automatically render user‑supplied documents without additional isolation.