Vulnerabilities

[Templore]

https://www.npmjs.com/package/xlsx

latest version 0.18.5 have two vulnerabilities

[JuanTorchia]

Hi @Templore,

Thank you for highlighting the security vulnerabilities in xlsx version 0.18.5. You're correct that this version has two significant vulnerabilities:

• CVE-2023-30533 (Score 7.5): Prototype Pollution via a crafted file
• CVE-2023-22365 (Score 7.5): Regular Expression Denial of Service (ReDoS)

These security issues have been addressed in newer versions. The recommended solution is to use SheetJS directly from their CDN with version 0.20.3:

yarn remove xlsx
yarn add xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz

For newer Yarn versions that require explicit package naming, use the xlsx@ prefix as shown above.

Note that if you're using Snyk security tooling, you might still see warnings about "Prototype Pollution" (SNYK-JS-XLSX-5457926), but according to SheetJS, these are false positives for versions 0.19.3 and later. Their official recommendation is to suppress these warnings.

Thanks for bringing attention to these security issues.

This information is also documented in the official SheetJS documentation: https://docs.sheetjs.com/docs/getting-started/installation/nodejs/

Since there's a clear solution available and the maintainers are aware of these issues, I believe this ticket can be closed. 👍

[e965]

If you don't want to give up the convenience of NPM, you can use these packages instead of xlsx, they are republished versions of the original package.

@e965/xlsx (https://github.com/SheetJS/sheetjs/issues/2822#issuecomment-1668303942) xlsx-republish (https://github.com/SheetJS/sheetjs/issues/2667#issuecomment-2354334791)

If you don't want to edit imports throughout the code, you can do it this way (for example):

- "xlsx": "0.18.5",
+ "xlsx": "npm:@e965/[email protected]",

[federicowoodward]

works fine

[cpena-flexion]

Hi, @JuanTorchia, my team upgraded to the latest version ("xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",), but Snyk still flagged it. This was tested using the Snyk CLI. Is this expected, an error, false positive?

✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-XLSX-6252523] in [email protected] introduced by [email protected] No upgrade or patch available

[GisaKaze]

Hi @Templore,

Thank you for highlighting the security vulnerabilities in xlsx version 0.18.5. You're correct that this version has two significant vulnerabilities:

• CVE-2023-30533 (Score 7.5): Prototype Pollution via a crafted file
• CVE-2023-22365 (Score 7.5): Regular Expression Denial of Service (ReDoS)

These security issues have been addressed in newer versions. The recommended solution is to use SheetJS directly from their CDN with version 0.20.3:

yarn remove xlsx
yarn add xlsx@https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz

For newer Yarn versions that require explicit package naming, use the xlsx@ prefix as shown above.

Note that if you're using Snyk security tooling, you might still see warnings about "Prototype Pollution" (SNYK-JS-XLSX-5457926), but according to SheetJS, these are false positives for versions 0.19.3 and later. Their official recommendation is to suppress these warnings.

Thanks for bringing attention to these security issues.

This information is also documented in the official SheetJS documentation: https://docs.sheetjs.com/docs/getting-started/installation/nodejs/

Since there's a clear solution available and the maintainers are aware of these issues, I believe this ticket can be closed. 👍

Hi, @JuanTorchia, I tried this way, but the Snyk test still flagged it.

[rotem1850]

I upgraded to 0.20.3 and still getting the security issue in snyk - SNYK-JS-XLSX-6252523

[beenh2we]

If you don't want to give up the convenience of NPM, you can use these packages instead of xlsx, they are republished versions of the original package.

@e965/xlsx (#2822 (comment)) xlsx-republish (#2667 (comment))

If you don't want to edit imports throughout the code, you can do it this way (for example):

• "xlsx": "0.18.5",

• "xlsx": "npm:@e965/[email protected]",

Works fine for me, thx..

[MrGavintech]

Hi, @JuanTorchia, my team upgraded to the latest version ("xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",), but Snyk still flagged it. This was tested using the Snyk CLI. Is this expected, an error, false positive?

✗ Regular Expression Denial of Service (ReDoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-XLSX-6252523] in [email protected] introduced by [email protected] No upgrade or patch available

➕ 1 Same here - I have not found any direct information that suggests suppressing this one, but only for prototype pollution. Not sure if this is just another false positive, but it appears that way. Even SNYK says it's fixed in 0.20.2, but it still complains that it is a vulnerability 🤷 .

Nothing was noted about ignoring the ReDoS SNYK-JS-XLSX-6252523 in here: https://docs.sheetjs.com/docs/getting-started/installation/nodejs/

However, I did find this: https://git.sheetjs.com/sheetjs/sheetjs/issues/3121 and this: https://cdn.sheetjs.com/advisories/CVE-2024-22363

It clearly says to upgrade to a version that SNYK still complains about.

[ihor-zinchenko]

is it still alive?

[RockyStrongo]

I am genuinely curious, why isn't this fixed using a standard npm release, could someone explain it to me ?

[Ben-CA]

Curious why this isn't being updated in npm? It gets over 3M downloads a week, for a version that has been vulnerable for years!

https://github.com/advisories/GHSA-4r6h-8v6p-xvw6

If the issue is they can't monetize it, then why don't they at least mark it as depreciated on NPM?

[e965]

@RockyStrongo @Ben-CA https://github.com/SheetJS/sheetjs/issues/2667

[DanielSharp01]

Can someone report them to NPM so they stop squatting the xlsx package name with their bullshit.

[ork-acro]

any update for synk ? "xlsx": "npm:@e965/[email protected]" still with the issue

[e965]

@ork-acro The vulnerability was fixed in 0.19.3. I can assume that the problem is that your vulnerability manager checks packages first by keys (package name), and only then by value (version used). The latest version of the xlsx package on npm is still 0.18.5 - accordingly, your dependency manager considers it a threat, no matter what you specify as a value.

[fractoholic]

Why would npm publishing have been abandoned?

[fractoholic]

I am genuinely curious, why isn't this fixed using a standard npm release, could someone explain it to me ?

seems fishy, for sure.

[clicktodev]

i understand the maintainer wants to self host the library but atleast give the choice of npm and cdn. also syncing the github repo with the self hosted gitea repo would be nice.

[smayoorans]

If you don't want to give up the convenience of NPM, you can use these packages instead of xlsx, they are republished versions of the original package.

@e965/xlsx (#2822 (comment)) xlsx-republish (#2667 (comment))

If you don't want to edit imports throughout the code, you can do it this way (for example):

• "xlsx": "0.18.5",

• "xlsx": "npm:@e965/[email protected]",

It works fine for me.