GHSA-xch6-rmr7-fh84HighCVSS 7.5
exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block...
🔗 CVE IDs covered (1)
📋 Description
exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues(), workbook writes and CSV export consume time proportional to that number.
🔗 References (8)
- https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-3gm5-qxj8-89rr
- https://nvd.nist.gov/vuln/detail/CVE-2026-128343
- https://github.com/exceljs/exceljs
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L571-L580
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L886-L893
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/row-xform.js#L73-L77
- https://www.vulncheck.com/advisories/exceljs-through-4.4.0-denial-of-service-via-oversized-row-number
- https://github.com/advisories/GHSA-xch6-rmr7-fh84