Executive brief
SheetJS is a widely-used JavaScript library for reading and writing spreadsheet files (Excel, CSV, etc.). Versions up to 0.19.2 contain a prototype pollution vulnerability that can be triggered by parsing specially crafted spreadsheet files. An attacker who can provide a malicious spreadsheet file to an application using SheetJS can potentially execute arbitrary code or cause the application to crash, affecting any service that processes user-supplied spreadsheets.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in SheetJS Community Edition affecting all versions through 0.19.2. The vulnerability exists in the file parsing logic and is triggered when the library processes specially crafted spreadsheet files. The attack requires user interaction (providing a malicious file), but no authentication or special privileges are needed. Workflows that only export data to spreadsheets without reading arbitrary files are unaffected. An attacker exploiting this vulnerability can modify JavaScript object prototypes to achieve code execution, bypass security checks, or cause denial of service. The fix is available in version 0.19.3 and later, available via the SheetJS CDN; however, the npm package is no longer maintained.
Affected products
- SheetJS Community Edition < 0.19.3
- xlsx < 0.19.3
Timeline
- 2023-04-24: disclosed
- 2023-04-17: patched: Version 0.19.3 released with fix available via SheetJS CDN