GitHub Advisoryadvisory · npm

GHSA-5pgg-2g8v-p4x9 SheetJS Regular Expression Denial of Service (ReDoS)

HIGH Published 2024-04-05 Modified 2025-09-19 Official page ↗
Aliases
CVE-2024-22363
Ecosystem
npm
Packages
xlsx
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333
Reviewed
2024-04-08

Affected packages

• npm xlsx: < 0.20.2 (no fix yet)

Description

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS). A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.

Related

Alias · CVE (1)

  • CVE-2024-22363 SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS). vulnerability

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References