Threats tagged 'ghsa-5pwm-xv7w-v3cm'

ExcelJS versions through 4.4.0 have a memory exhaustion vulnerability in the Worksheet._parseMergeCells function. This flaw allows attackers to crash applications by providing unbounded mergeCell ranges in crafted Excel workbooks. Specifically, a mergeCell reference such as A1:XFD1048576 causes the xlsx.load() method to create billions of Row and Cell objects, leading to process abortion due to resource exhaustion.