Threats tagged 'ghsa-66pw-fcw9-5qqq'

ExcelJS versions through 4.4.0 have a resource leak vulnerability in the streaming WorkbookReader.parse function. This flaw causes temporary files and open file descriptors to remain when sheet parsing fails or iteration stops early. An attacker can exploit this by uploading malformed multi-sheet workbooks with worksheets placed before xl/sharedStrings.xml, leading to exhaustion of temporary directory space and file descriptors.