| Where | Details |
|---|
| Advisory | GHSA-crq2-phg8-4xvg, responsibly reported by rbbjinioeq. |
| Root cause | The XLSX parser accepted a non-hexadecimal sheetPr/tabColor@rgb value. The viewer interpolated that value into a complete style.cssText serialization, allowing semicolons in workbook data to begin additional CSS declarations. |
| Impact | A board member could alter the attachment-preview presentation seen by another member and cause a CSS subresource request. No JavaScript execution, response reading, credential access or authenticated state change was demonstrated. |
| Fix | The vendored viewer now accepts only canonical #RRGGBB values immediately before CSS serialization. Invalid, short, alpha, named and declaration-bearing values become no tab color. |
| Regression coverage | tests/xlsxTabColorCssInjection.test.cjs checks a valid control and rejects the disclosure payload plus malformed boundary cases. |
