Snyk Security Database

exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via Workbook.xlsx.load() in lib/xlsx/xlsx.js. An attacker can exhaust memory and crash the process by supplying a highly compressible .xlsx file that expands into a very large amount of data during ZIP decompression. Services that call load() or readFile() on untrusted uploads are affected: the workbook loader decompresses archive entries into memory before XML parsing, so a small crafted file can trigger an out-of-memory termination and deny service to users.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Run load() inside a process or container with a hard memory limit, so a decompression bomb can only crash that isolated process instead of exhausting the host.
• Pre-check the uploaded .xlsx file’s declared uncompressed sizes from the ZIP central directory before calling load(), so oversized archives are rejected before decompression begins.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol via the downloader. An attacker can execute arbitrary code and compromise system integrity by injecting malicious package contents during a man-in-the-middle attack or DNS poisoning, which are then extracted without validation.

Affected versions of this package are vulnerable to Improper Neutralization through the CONNECT and PUBLISH encoding paths in MqttEncoder and MqttCodecUtil. An attacker can send MQTT fields containing NUL bytes or wildcard characters by supplying crafted client identifiers, usernames, will topics, or publish topic names. The encoder writes these strings into MQTT packets without rejecting illegal characters, so an application built on the codec can emit malformed MQTT messages that brokers interpret differently from the application’s own checks. In practice, this can let an attacker bypass topic or client-ID restrictions and publish to unintended topics or connect under a colliding identifier, breaking access controls and session isolation.