exceljs@0.2.27

exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON.

Affected versions of this package are vulnerable to Prototype Pollution through Note.model serialization in lib/utils/under-dash.js. An attacker can modify Object.prototype and influence later plain-object behavior by supplying user-controlled JSON as cell.note with a __proto__ property and triggering workbook serialization.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Do not pass unvalidated or parsed JSON directly into cell.note; this prevents attacker-controlled __proto__-bearing note objects from reaching deepMerge() and polluting Object.prototype.
• If cell.note must come from user input, allow-list only the expected keys: texts, margins, protection, and editAs; this blocks unexpected prototype-polluting properties from being merged during workbook serialization.

Upgrade exceljs to version 5.0.0 or higher.

exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON.

Affected versions of this package are vulnerable to CSV Injection through the CSV.write() process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell value that begins with =, +, -, or @ and getting it exported through workbook.csv.write(), writeBuffer(), or writeFile(). When a victim opens the exported CSV in Excel or LibreOffice Calc, the injected value is treated as a live formula, enabling command execution tricks, external data fetches, or exfiltration of other cells in the spreadsheet.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Sanitize values yourself before calling workbook.csv.write(): prefix any string beginning with =, +, -, @, tab, or CR with a single quote ('). This prevents spreadsheet applications from interpreting attacker-controlled cell data as live formulas when you open the CSV.
• Avoid opening CSV exports of user-influenced data directly in a spreadsheet application. This prevents Excel or LibreOffice Calc from triggering formula execution on untrusted exports.

Upgrade exceljs to version 5.0.0 or higher.

exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON.

Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImage({filename}) in lib/xlsx/xlsx.js (addMedia()). An attacker can read arbitrary files accessible to the Node.js process by supplying a filename fragment that escapes the intended base directory, causing the chosen file to be embedded into the generated .xlsx download as an image.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Do not build the addImage({filename}) path with path.join() from a base directory plus user input alone; resolve the final path and verify it still starts with the intended base directory before passing it to addImage(), which blocks ../ traversal into arbitrary readable files.
• Map user-supplied image names to a fixed allowlist of known-safe file paths instead of accepting an arbitrary path fragment, which prevents attackers from selecting paths outside the intended asset set.

Upgrade exceljs to version 5.0.0 or higher.