The master branch of Extension:DataTransfer requires version 1.19.0 of phpoffice/phpspreadsheet. Running composer audit reports
Found 2 security vulnerability advisories affecting 1 package: +-------------------+----------------------------------------------------------------------------------+ | Package | phpoffice/phpspreadsheet | | CVE | CVE-2024-45048 | | Title | XXE in PHPSpreadsheet encoding is returned | | URL | https://github.com/advisories/GHSA-ghg6-32f9-2jp7 | | Affected versions | >=2.0.0,<2.1.1|>=2.2.0,<2.2.1|<1.29.1 | | Reported at | 2024-08-29T17:58:27+00:00 | +-------------------+----------------------------------------------------------------------------------+ +-------------------+----------------------------------------------------------------------------------+ | Package | phpoffice/phpspreadsheet | | CVE | CVE-2024-45046 | | Title | PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style | | | information | | URL | https://github.com/advisories/GHSA-wgmf-q9vr-vww6 | | Affected versions | <1.29.1|>=2.0.0,<2.1.0 | | Reported at | 2024-08-29T17:56:56+00:00 | +-------------------+----------------------------------------------------------------------------------+
Solution: Bump to version 1.29.1
Current maintainer of this extension: @Yaron_Koren