Threats tagged 'ghsa-3wrp-r2q4-573c'

ExcelJS versions up to 4.4.0 have a prototype pollution vulnerability. This flaw allows attackers to add numeric keys to Object.prototype by crafting an XLSX file with a defined name referencing a __proto__ sheet. When such a file is loaded using workbook.xlsx.load(), it causes the CellMatrix component to write empty arrays onto Object.prototype, affecting the process globally.