CVE-2018-16459: XSS
An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.
Other sources
Versions of exceljs before 1.6.0 are vulnerable to cross-site scripting.
This vulnerability is due to exceljs not validating data from parsed XLSX file and embedding HTML tags, like <script> directly into the sheet cells. Because of this it's possible to inject malicious JavaScript code and execute it when data from the sheet is displayed in the browser.
Recommendation
Update to version 1.6.0 or later.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using exceljs before 1.6.0 are exposed when they parse XLSX files and display worksheet cell values in a browser. The risk is particularly relevant if XLSX content can originate from untrusted sources.
What does an attacker need to exploit it?
An attacker needs to supply an XLSX file containing HTML tags or malicious JavaScript in a cell value, and a user must view the resulting worksheet in a browser. No attacker privileges are required.
Are default installations affected?
Any use of a vulnerable exceljs version before 1.6.0 can be affected if parsed worksheet data is embedded in a browser without safe handling. The issue stems from cell data not being validated before HTML is embedded.
What should be done if an immediate upgrade is not possible?
Avoid displaying cell values from untrusted XLSX files as HTML in a browser. Treat parsed cell content as untrusted data and ensure it is not embedded as executable HTML.
How can I determine whether an application is affected?
Check whether the application depends on exceljs before version 1.6.0 and whether it parses XLSX files whose worksheet data is rendered in a browser. Test or review the rendering path for cell values containing HTML tags such as script elements.