CVE-2018-16459

An unescaped payload in exceljs v1.6 allows a possible XSS via cell value when worksheet is displayed in browser...

CVE-2018-16459

Summary: CVE-2018-16459 relates to the exceljs library. Affected software: exceljs prior to 1.6.0. Vulnerability: unescaped payload in cell values leads to cross-site scripting (XSS) when a worksheet is rendered in a browser, because parsed XLSX data is not validated and HTML tags (e.g., [removed...