Quick answers
- Is CVE-2023-30533 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2023-30533 being exploited in the wild.
- How severe is CVE-2023-30533?
- Low severity, with a CVSS score of 3.1, published 24 April 2023.
- Which products and versions are affected?
- xlsx (npm) SEMVER:introduced=0; SheetJS Community Edition < 0.19.3.
- Is there a fix for CVE-2023-30533?
- A patch was published on 2023-04-17: Version 0.19.3 released with fix available via SheetJS CDN Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2023-30533 attacked?
- It is attacked with local access, in a software library.
- Am I affected by CVE-2023-30533?
- Check whether you run xlsx (npm) or SheetJS Community Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a prototype pollution vulnerability (CWE-1321) in SheetJS Community Edition affecting all versions through 0.19.2. The vulnerability exists in the file parsing logic and is triggered when the library processes specially crafted spreadsheet files. The attack requires user interaction (providing a malicious file), but no authentication or special privileges are needed. Workflows that only export data to spreadsheets without reading arbitrary files are unaffected. An attacker exploiting this vulnerability can modify JavaScript object prototypes to achieve code execution, bypass security checks, or cause denial of service. The fix is available in version 0.19.3 and later, available via the SheetJS CDN; however, the npm package is no longer maintained.
Affected products
- SheetJS Community Edition < 0.19.3
- xlsx < 0.19.3
Identifiers
- CVE-2023-30533
- GHSA-4r6h-8v6p-xvw6
Timeline
- 2023-04-24: disclosed
- 2023-04-17: patched: Version 0.19.3 released with fix available via SheetJS CDN