From 31f0c370be4b95ac4fa285fea3be970606735f16 Mon Sep 17 00:00:00 2001 From: Michael Williamson Date: Fri, 28 Aug 2026 14:39:48 +0100 Subject: Avoid prototype pollution when reading styles --- NEWS | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'NEWS') diff --git a/NEWS b/NEWS index 5f954c3..1206dac 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,9 @@ +# 1.12.2 + +* Avoid prototype pollution when reading the styles defined in a document. This + avoids an issue where a maliciously crafted document could be used to set + externalFileAccess to true. + # 1.12.1 * Fix: on Windows, when an image's content type includes a backslash in the -- cgit v1.2.3