Is CVE-2018-16459 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2018-16459 being exploited in the wild.

How severe is CVE-2018-16459?

Low severity, with a CVSS score of 3, published 11 September 2018.

Which products and versions are affected?

exceljs (npm) SEMVER:introduced=0,fixed=1.6.0.

Is there a fix for CVE-2018-16459?

Yes. exceljs (npm): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2018-16459 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2018-16459?

Check whether you run exceljs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2018-16459: exceljs Cross-Site Scripting in XLSX cell parsing

CVE-2018-16459 · Severity: low · CVSS 3 · Published 2018-09-11

The exceljs library, used for reading and writing Excel files in Node.js applications, is vulnerable to a security flaw that allows malicious code to be embedded in spreadsheet cells. If an application uses this library to display spreadsheet data in a web browser, an attacker could execute unauthorized scripts in the user's session. This could lead to the theft of sensitive information, such as login tokens, or unauthorized actions performed on behalf of the user.

Technologies: exceljs (npm). Vendors: npm.

Quick answers

Is CVE-2018-16459 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2018-16459 being exploited in the wild.
How severe is CVE-2018-16459?: Low severity, with a CVSS score of 3, published 11 September 2018.
Which products and versions are affected?: exceljs (npm) SEMVER:introduced=0,fixed=1.6.0.
Is there a fix for CVE-2018-16459?: Yes. exceljs (npm): upgrade to 1.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2018-16459 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2018-16459?: Check whether you run exceljs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

exceljs (npm): upgrade to 1.6.0 or later
```
npm install exceljs@1.6.0
```

Technical details

A Cross-Site Scripting (XSS) vulnerability exists in exceljs versions prior to 1.6.0. The library fails to properly sanitize or escape data parsed from XLSX files before it is embedded into HTML tags within sheet cells. An attacker can craft a malicious XLSX file containing script tags (e.g., <script>alert(1)</script>) in cell values. When a web application uses the library to render this spreadsheet data in a browser, the injected scripts execute in the context of the user's session. This is classified as CWE-79 and requires the victim to view the malicious spreadsheet data. The issue is resolved in version 1.6.0.

Affected products

exceljs project exceljs < 1.6.0

Identifiers

CVE-2018-16459
GHSA-2j2j-8rrv-264g

Timeline

2018-05-24: other: Vulnerability reported via HackerOne
2018-09-06: disclosed: NVD publication date
2018-09-11: advisory: GitHub Advisory published
2018-09-11: patched: Version 1.6.0 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.