External Control of File Name or Path Affecting exceljs package, versions <5.0.0

exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON.

Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImage({filename}) in lib/xlsx/xlsx.js (addMedia()). An attacker can read arbitrary files accessible to the Node.js process by supplying a filename fragment that escapes the intended base directory, causing the chosen file to be embedded into the generated .xlsx download as an image.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Do not build the addImage({filename}) path with path.join() from a base directory plus user input alone; resolve the final path and verify it still starts with the intended base directory before passing it to addImage(), which blocks ../ traversal into arbitrary readable files.
• Map user-supplied image names to a fixed allowlist of known-safe file paths instead of accepting an arbitrary path fragment, which prevents attackers from selecting paths outside the intended asset set.

• GitHub Commit
• Maintainer's Advisory
• Vulnerable Code
• Vulnerable Code
• Vulnerable Code xlsx.js:375-386