The vulnerability stems from PhpSpreadsheet’s HTML Writer skipping the standard escaping routine when a custom number format contains the @ placeholder followed by quoted literal text. In this scenario, the library substitutes the raw cell value directly into the HTML output, allowing any embedded markup to be rendered. An attacker supplying malicious cell contents can inject arbitrary HTML or JavaScript, leading to cross‑site scripting attacks once the HTML export is served to users. This flaw is a classic XSS weakness (CWE‑79).

The flaw is present in all PHPOffice:PhpSpreadsheet releases from 1.30.3 through 5.6.0, except the patched versions 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0. Environments that use any of those vulnerable versions and employ the HTML Writer to convert spreadsheets to HTML are exposed.

The base CVSS score of 4.8 reflects a moderate risk. No EPSS data is currently available, and the vulnerability is not listed in CISA KEV. Exploitation requires delivering a spreadsheet file that will be processed by the HTML Writer, so systems that load third‑party spreadsheet data and render it as HTML are the primary targets. Successful exploitation permits arbitrary script injection, which could deface pages, harvest session cookies, or enable phishing, but it does not provide direct remote code execution or privilege escalation on its own.