Prototype Pollution in sheetJS

HIGH 7.8CVE-2023-30533 · GHSA-4r6h-8v6p-xvw6 · Published 24/04/2023 · updated 17/06/2026

In short

CVE-2023-30533 is a HIGH (CVSS 7.8) vulnerability affecting sheetjs (sheetjs), xlsx.
Chance of exploitation in the next 30 days (EPSS): 0.99%, higher than 62.5% of all vulnerabilities.
Fix: update to 0.19.3 or later.

Package	Affected versions	Patched versions
sheetjs sheetjs	`< 0.19.3`	`0.19.3`
xlsx npm	`all versions`	No fix yet

Description

All versions of SheetJS CE through 0.19.2 are vulnerable to "Prototype Pollution" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.

A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.19.3 can be downloaded via https://cdn.sheetjs.com/.

NVD description

SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.

References

nvd.nist.gov/vuln/detail/CVE-2023-30533 · ADVISORY
cdn.sheetjs.com · WEB
cdn.sheetjs.com/advisories/CVE-2023-30533 · WEB
git.sheetjs.com/sheetjs/sheetjs · PACKAGE
git.sheetjs.com/sheetjs/sheetjs/issues/2667 · WEB
git.sheetjs.com/sheetjs/sheetjs/issues/2986 · WEB
git.sheetjs.com/sheetjs/sheetjs/src/branch/master/CHANGELOG.md · WEB

More vulnerabilities in sheetjs

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

sheetjs

< 0.19.3

0.19.3

xlsx

npm

all versions

No fix yet

Description

NVD description

SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.