External Control of File Name or Path Affecting exceljs-hardened package, versions <5.0.0

Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImage({filename}) in lib/xlsx/xlsx.js (addMedia()). An attacker can read arbitrary files accessible to the Node.js process by supplying a filename fragment that escapes the intended base directory, causing the chosen file to be embedded into the generated .xlsx download as an image.

Notes

• The vulnerability is still present in upstream exceljs; an unofficial fork - exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.

Workarounds

• Do not build the addImage({filename}) path with path.join() from a base directory plus user input alone; resolve the final path and verify it still starts with the intended base directory before passing it to addImage(), which blocks ../ traversal into arbitrary readable files.
• Map user-supplied image names to a fixed allowlist of known-safe file paths instead of accepting an arbitrary path fragment, which prevents attackers from selecting paths outside the intended asset set.

• GitHub Commit
• Maintainer's Advisory
• Vulnerable Code
• Vulnerable Code
• Vulnerable Code xlsx.js:375-386