Crafted files trigger prototype pollution and ReDoS
Reading crafted spreadsheet files triggers prototype pollution and ReDoS flaws, and the npm package still lists known vulnerabilities.
Tier II · Emerging Problems that are still building up.
3 public reports · first reported 27 April 2023 · last reported 2 March 2025
What's going wrong
Developers who parse spreadsheet uploads report that reading specially crafted files can trigger prototype pollution in the SheetJS library, and a related regular expression denial-of-service weakness has been raised too.
AI-assisted: written with the help of AI from the reports. The idea report has the full summary.
In the idea report
- The full summary.
- The products the 3 reports are about, and how many came each month.
- Related problems.
No business has been found with this problem yet, so the report has no contacts. All sales are final — no refunds. Pricing.