Description

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).

Remediation

References

https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/

https://sheetjs.com/pro

https://www.npmjs.com/package/xlsx/v/0.17.0

https://www.oracle.com/security-alerts/cpujan2022.html

Related Vulnerabilities

CVE-2023-26129 Vulnerability in npm package bwm-ng

CVE-2020-7604 Vulnerability in npm package pulverizr

CVE-2018-19362 Vulnerability in maven package com.fasterxml.jackson.core:jackson-databind

CVE-2021-27582 Vulnerability in maven package org.mitre:openid-connect-server

CVE-2022-21129 Vulnerability in npm package nemo-appium

Severity

Medium

Classification

CWE-400 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Tags

Third Party Advisory Product Vendor Advisory Patch