CVE-2023-30533: High severity sheetjs vulnerability
All versions of SheetJS CE through 0.19.2 are vulnerable to "Prototype Pollution" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.
A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained.
Other sources
SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for SheetJS Community Edition?
The vulnerability ID for SheetJS Community Edition is CVE-2023-30533.
What is the severity rating of CVE-2023-30533?
CVE-2023-30533 has a severity rating of 7.8 (high).
What is the impact of the SheetJS Community Edition vulnerability?
The SheetJS Community Edition vulnerability allows Prototype Pollution via a crafted file.
What versions of SheetJS CE are affected by CVE-2023-30533?
All versions of SheetJS CE through 0.19.2 are affected by CVE-2023-30533.
How can I mitigate the vulnerability in SheetJS Community Edition?
To mitigate the vulnerability in SheetJS Community Edition, update to version 0.19.3 or higher.