xlsx@0.15.4 vulnerabilities

SheetJS Spreadsheet data parser and writer

Direct Vulnerabilities

Known vulnerabilities in the xlsx package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Prototype Pollution

xlsx is a Parser and writer for various spreadsheet formats.

Affected versions of this package are vulnerable to Prototype Pollution when reading specially crafted files.

Note:

  1. The issue is resolved in version 0.19.3 of SheetJS that is distributed only via the authoritative source for SheetJS modules.

  2. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.

How to fix Prototype Pollution?

A fix was pushed into the master branch but not yet published.

*
  • H
Denial of Service (DoS)

xlsx is a Parser and writer for various spreadsheet formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). An attacker who can send a malicious excel file parsed by this library can crash the Node.JS process.

How to fix Denial of Service (DoS)?

Upgrade xlsx to version 0.17.0 or higher.

<0.17.0
  • H
Denial of Service (DoS)

xlsx is a Parser and writer for various spreadsheet formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). An attacker who can send a malicious excel file parsed by this library can crash the Node.JS process.

How to fix Denial of Service (DoS)?

Upgrade xlsx to version 0.17.0 or higher.

<0.17.0
  • H
Denial of Service (DoS)

xlsx is a Parser and writer for various spreadsheet formats.

Affected versions of this package are vulnerable to Denial of Service (DoS). An attacker who can send a malicious excel file parsed by this library can cause maximum CPU usage.

How to fix Denial of Service (DoS)?

Upgrade xlsx to version 0.17.0 or higher.

<0.17.0
  • L
Regular Expression Denial of Service (ReDoS)

xlsx is a Parser and writer for various spreadsheet formats.

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS). This can cause an impact of about 2 seconds matching time for data 50k characters long. This vulnerability is due to an incomplete fix for SNYK-JS-XLSX-10909.

How to fix Regular Expression Denial of Service (ReDoS)?

Upgrade xlsx to version 0.16.0 or higher.

<0.16.0