External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImagefilename in lib/xlsx/xlsx.js addMedia. An attacker can read arbitrary files accessible to the Node.js process by supplying a filename fragment that escapes the intended base...