HighGHSA-5pgg-2g8v-p4x9CVE-2024-22363

SheetJS Regular Expression Denial of Service (ReDoS)

Published 5 Apr 2024 · Updated 10 Sept 2026

Affected package

Affected: All versions
Fixed in: No fix released

Details

SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).

A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.

Is GHSA-5pgg-2g8v-p4x9 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected xlsx, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2024-22363
Linkcdn.sheetjs.com
Linkcdn.sheetjs.com/advisories/CVE-2024-22363
Linkcwe.mitre.org/data/definitions/1333.html
Packagegit.sheetjs.com/sheetjs/sheetjs
Linkgit.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.