Description
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal heap out-of-memory error during xlsx.load().
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| exceljs | exceljs | ≤ 4.4.0 | — |
References
- https://github.com/exceljs/exceljs product
- GitHub Security Advisory (GHSA-qvh4-wwpm-ggc8) third-party-advisory
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/cell-matrix.js#L28-L37 technical-description
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/defined-names.js#L182-L193 technical-description
- VulnCheck Advisory: ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range third-party-advisory