Threats tagged 'ghsa-2vgm-9qpx-xwqx'

ExcelJS versions up to 4.4.0 have a prototype pollution vulnerability in the mergeConditionalFormattings function. This flaw allows attackers to modify Object.prototype by crafting an xlsx file with a specific x14:cfRule id of __proto__. When such a file is loaded using xlsx.load(), it can set or overwrite properties on all objects processed, potentially causing integrity and availability issues.