AIKIDO-2026-794192

TL;DR

officeparser parses OpenDocument files by expanding cells and rows marked with the table:number-columns-repeated and table:number-rows-repeated attributes into individual nodes while building its document tree. Because these repeat counts are multiplied together and materialized without any cap, a small crafted spreadsheet can request an enormous number of cells, exhausting process memory after the ZIP decompression limits have already passed, which can crash the process handling untrusted files. The fix introduces a per-document table-cell budget that clamps the total number of materialized cells and emits a warning instead of expanding without limit. The same release also hardens output sanitization against a residual CSS-escape cross-site scripting bypass and guards configuration merging against prototype pollution from untrusted JSON.parse config input.