Description
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load() to create billions of Row and Cell objects and abort the process.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| exceljs | exceljs | ≤ 4.4.0 | — |
References
- https://github.com/exceljs/exceljs product
- GitHub Security Advisory (GHSA-wh3v-83h4-rwwq) third-party-advisory
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L613-L632 technical-description
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/worksheet.js#L895-L901 technical-description
- https://github.com/exceljs/exceljs/issues/3107 issue-tracking
- https://github.com/exceljs/exceljs/pull/3114 issue-tracking patch
- VulnCheck Advisory: ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range third-party-advisory