EUVD-2026-64681
GHSA-r7gv-hxj8-94c4
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered upload with no authentication or complexity barriers; scope unchanged; impact is availability-only with no confidentiality or integrity exposure.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
AnalysisAI
Unbounded xlsx decompression in exceljs-hardened before 5.0.0 allows unauthenticated remote attackers to exhaust server memory and cause denial of service by uploading a crafted zip-bomb workbook. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects that exploitation requires no authentication, no special configuration, and no victim interaction beyond the server automatically parsing the uploaded file. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Any application that accepts xlsx file uploads from untrusted users and passes them directly to exceljs-hardened versions before 5.0.0 is vulnerable. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 accurately captures the low exploitation barrier: no authentication, no attack complexity, and no required preconditions make this straightforward to trigger against any exposed xlsx upload endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker constructs a zip-bomb xlsx file in which a small compressed archive (e.g., under 1 MB on disk) contains entries that decompress to several gigabytes of repeated data. The attacker submits this file to any HTTP endpoint backed by exceljs-hardened prior to 5.0.0, causing the server process to exhaust available RAM during parsing and triggering an out-of-memory condition or crash. … |
| Remediation | Upgrade exceljs-hardened to version 5.0.0 or later, which introduces enforcement of limits on per-entry decompressed size, total uncompressed size, and compression ratio. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all production systems to identify instances of exceljs-hardened library in use and determine whether they accept Excel file uploads from untrusted sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser. Rated
Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed J
Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server
CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values t
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today