xlsx

SheetJS The SheetJS Community Edition offers battle-tested open-source solutions for extracting useful data from almost any complex spreadsheet and generating new spreadsheets that will work with legacy and modern software alike. SheetJS Pro offers solutions beyond data processing: Edit complex...

CVE-2023-30533

POC - CVE-2023-30533 Un POC para CVE-2023-30533 Copiado según: https://cdn.sheetjs.com/advisories/CVE-2023-30533: Todas las versiones de SheetJS Community Edition hasta la versión 0.19.2 están afectadas. Esto incluye: - scripts y módulos en el CDN de SheetJS hasta la versión 0.19.2 2 - módulos...

CVE-2026-93405

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405 Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote...

CVE-2026-93405

The Mailspring email client is vulnerable to Stored XSS in the attachment quick preview feature in versions prior to 1.17.0 . The application fails to sanitize HTML generated from Markdown, DOCX, and XLSX attachments converted via Snarkdown, Mammoth, and SheetJS, inserting the result into the pre...

PT-2026-98230

Name of the Vulnerable Software and Affected Versions Mailspring versions prior to 1.17.0 Description The attachment quick preview feature converts Markdown, DOCX, and XLSX attachments using Snarkdown, Mammoth, and SheetJS, then inserts the resulting HTML into the preview document via innerHTML...

CVE-2026-44549: Improper Neutralization of Input During Web Page Generation

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.8.0, Excel file attachments are previewed in an unsafe way. A crafted XLSX file payload can be used to cause the sheetjs function sheettohtml to embed an XSS payload into the generated...

EUVD-2021-1438

Malware in sbrugna...

EUVD-2021-1453

Malware in sbrugna...

EUVD-2021-1466

Malware in sbrugna...

EUVD-2023-1194

Malicious code in bioql PyPI...

CVE-2024-22363

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service ReDoS...

CVE-2023-30533

SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected...

CVE-2021-32014

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service CPU consumption via a crafted .xlsx document that is mishandled when read by xlsx.js...

CVE-2021-32012

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service memory consumption via a crafted .xlsx document that is mishandled when read by xlsx.js issue 1 of 2...

CVE-2021-32013

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service memory consumption via a crafted .xlsx document that is mishandled when read by xlsx.js issue 2 of 2...

SheetJS Regular Expression Denial of Service (ReDoS)

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service ReDoS. A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com...

GHSA-5PGG-2G8V-P4X9 SheetJS Regular Expression Denial of Service (ReDoS)

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service ReDoS. A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com...