Threats tagged 'ghsa-6jvr-mc45-ggjp'

ExcelJS versions through 4.4.0 have a resource exhaustion vulnerability in the data-validations-xform.js component. This flaw allows attackers to supply unbounded sqref ranges in crafted workbooks, causing the xlsx.load() function to iterate over billions of addresses. The result is CPU and memory exhaustion, blocking the event loop and crashing the process with an uncatchable out-of-memory error.