Executive brief
SheetJS Pro is a popular JavaScript library for reading and writing Excel spreadsheets. A vulnerability in versions through 0.16.9 allows an attacker to craft a malicious .xlsx file that causes excessive CPU consumption when processed, potentially crashing applications or making them unresponsive. This could disrupt business operations if users or systems process untrusted Excel files.
Technical details
The vulnerability is a denial of service issue triggered by improper handling of malformed .xlsx documents during parsing. The attack vector is local with user interaction required—a victim must open or process a crafted Excel file with the vulnerable library. An attacker can cause CPU exhaustion by triggering algorithmic inefficiencies in the xlsx.js parsing logic. The issue is rooted in insufficient input validation (CWE-345, CWE-400). The vulnerability was fixed in version 0.17.0; users should upgrade immediately.
Affected products
- SheetJS xlsx through 0.16.9
Timeline
- 2021-07-22: disclosed: Advisory published
- 2021: patched: Fixed in version 0.17.0