high7.5
CVE-2024-22363
SheetJS Regular Expression Denial of Service (ReDoS)
Impact
SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS). A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | xlsx | < 0.20.2 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| SheetJS | SheetJS Community Edition | before 0.20.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://cdn.sheetjs.com/advisories/CVE-2024-22363
- https://cwe.mitre.org/data/definitions/1333.html
- https://git.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2
- https://github.com/advisories/GHSA-5pgg-2g8v-p4x9
- https://nvd.nist.gov/vuln/detail/CVE-2024-22363
- https://cdn.sheetjs.com