Skip to content
OpenAdvisories
Medium · 6.1 CVE-2018-16459 EUVD-2018-0433GHSA-2j2j-8rrv-264g

Cross-Site Scripting in exceljs

Published Sep 6, 2018 · Updated Sep 17, 2024 · Assigned by hackerone

Vendor: https://github.com/guyonroche Product: exceljs Package: exceljs Ecosystem: npm

Description

An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.

Affected products

VendorProductAffectedFixed
https://github.com/guyonroche exceljs 1.6.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
npm exceljs < 1.6.0 1.6.0 GHSA-2j2j-8rrv-264g

References