GitHub Advisoryadvisory · npm

GHSA-2j2j-8rrv-264g Cross-Site Scripting in exceljs

MEDIUM Published 2018-09-11 Modified 2023-09-13 Official page ↗
Aliases
CVE-2018-16459
Ecosystem
npm
Packages
exceljs
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2020-06-16

Affected packages

• npm exceljs: < 1.6.0 → fixed in 1.6.0

Description

Versions of `exceljs` before 1.6.0 are vulnerable to cross-site scripting. This vulnerability is due to `exceljs` not validating data from parsed XLSX file and embedding HTML tags, like `` directly into the sheet cells. Because of this it's possible to inject malicious JavaScript code and execute it when data from the sheet is displayed in the browser. Recommendation Update to version 1.6.0 or later.

Related

Alias · CVE (1)

  • CVE-2018-16459 An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References