CVE-2024-44085

Name of the Vulnerable Software and Affected Versions ONLYOFFICE Docs versions prior to 8.1.0

Description The issue is related to a cross-site scripting (XSS) flaw in ONLYOFFICE Docs, which occurs through a GeneratorFunction Object attack on a macro. This is connected to the use of an immediately-invoked function expression.

Recommendations For versions prior to 8.1.0, update to version 8.1.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of macros in ONLYOFFICE Docs until the update is applied.