Threats tagged 'ghsa-mc6q-q9x7-hr35'

ExcelJS versions through 4.4.0 have a formula injection vulnerability in the totals row formula getter located in lib/doc/table.js. The vulnerability arises because certain characters ([, ], #, and ') in structured reference column names are not properly escaped. Attackers can exploit this by supplying malicious column names containing the ] character via untrusted input such as imported CSV headers. This can lead to injection of formulas like HYPERLINK that may exfiltrate cell values when users open and interact with the generated workbook.