Threat Intelligence Database

exceljs-hardened versions before 5.0.0 contain a prototype pollution vulnerability in the deepMerge helper function. This vulnerability arises because the function does not reject special keys such as __proto__, constructor, or prototype when merging note objects. An attacker can exploit this by assigning a parsed JSON object with a malicious __proto__ property to cell notes, which modifies Object.prototype and impacts all plain objects created thereafter. The vulnerability has a critical severity with a CVSS score of 9.4.

exceljs-hardened versions before 5.0.0 do not properly neutralize leading special characters (=, +, -, @) in cell values when exporting to CSV. This allows attackers who can control exported cell values to inject formulas that execute upon opening the CSV in spreadsheet software, potentially leading to data exfiltration or other malicious actions.

A path traversal vulnerability exists in exceljs-hardened versions before 5.0.0 in the Workbook.addImage() function. This flaw allows attackers to supply arbitrary file paths, enabling them to read any file accessible to the Node.js process and embed its contents into the generated workbook. The vulnerability has a high severity rating with a CVSS score of 7.5.

A vulnerability in exceljs-hardened versions before 5.0.0 allows decompression of all entries from supplied XLSX archives into memory without limits on entry size, total size, or compression ratio. This can enable attackers to upload highly compressed workbooks that expand to gigabytes in memory, exhausting system resources and causing a denial of service condition.