CVE-2024-22363

HIGH7.5EPSS 0.14%

SheetJS Regular Expression Denial of Service (ReDoS)

Published: 4/5/2024Modified: 2/4/2026

Also known as:GHSA-5pgg-2g8v-p4x9CGA-xpm3-p7wj-cf9r

Description

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS). A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.

Affected packages (1)

npm/xlsxfrom 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References (6)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-22363
PATCHhttps://git.sheetjs.com/sheetjs/sheetjs
WEBhttps://cdn.sheetjs.com
WEBhttps://cdn.sheetjs.com/advisories/CVE-2024-22363
WEBhttps://cwe.mitre.org/data/definitions/1333.html
WEBhttps://git.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2