The odf-kit library, used to read, write, and convert OpenDocument files, contains a flaw where inline CSS styles are inserted into the generated HTML without proper escaping. When the document’s style attributes such as fo:color, fo:background-color, or fo:font-family are copied verbatim into the style attribute of HTML elements, a crafted value that includes a quotation mark or script tag can close the attribute early and inject executable JavaScript. This vulnerability leads to cross‑site scripting when a malicious ODT file is rendered in a browser, enabling defacement, cookie theft, or other client‑side attacks.

Any project or application that imports the GitHubNewbie0:odf-kit package with a version from 0.6.0 up to, but not including, 0.14.2 is affected. The vulnerability exists in the renderer that converts ODT to HTML, and its impact is realized when the resulting HTML is served or displayed in a web context. All styled elements—paragraphs, headings, table cells, images, and inline spans—are potentially exploitable unless the affected versions are patched.

The CVSS score of 6.1 indicates moderate impact. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. The likely attack vector is that an attacker supplies a crafted ODT file that contains malicious style values. If that file is rendered by the vulnerable library in a trusted web context, the injected JavaScript runs with the privileges of the viewing user. The risk is higher for applications that automatically render user‑supplied documents without additional isolation or content filtering.