Threats tagged 'ghsa-jf4h-9vf8-6gmp'

ExcelJS versions through 4.4.0 have an arbitrary file read vulnerability in the streaming WorkbookWriter component. This flaw allows attackers to read local files by supplying crafted image filenames with ../ path traversal sequences to the addImage function. The vulnerability enables embedding any file readable by the Node.js process into the generated workbook under xl/media.