CVE-2024-22363
SheetJS Regular Expression Denial of Service (ReDoS)
SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).
- Record
CVE-2024-22363- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
EUVDEUVD-2024-1106
SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).
- Record
EUVD-2024-1106- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5pgg-2g8v-p4x9
SheetJS Regular Expression Denial of Service (ReDoS)
SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).
A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.
- Record
GHSA-5pgg-2g8v-p4x9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
NVD
SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).
- Record
CVE-2024-22363- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVGHSA-5pgg-2g8v-p4x9
SheetJS Regular Expression Denial of Service (ReDoS)
SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).
A non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package xlsx are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.
- Record
GHSA-5pgg-2g8v-p4x9- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVCLSA-2026-1771978233 No score
TuxCare security update for xlsx (2 CVEs)
TuxCare rebuilt xlsx to address 2 CVEs. Fixed in 0.18.5-tuxcare.1.
- Record
CLSA-2026-1771978233- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2024-22363 No score
CVE-2024-22363 in @rootio/xlsx - Patched by Root
Root has patched CVE-2024-22363 in the @rootio/xlsx package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2024-22363- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xlsxnpm |
before 0.20.2 | 0.20.2 |
xlsxTuxCare:npm From an advisory covering 2 CVEs |
0.18.5-tuxcare.0 up to 0.18.5-tuxcare.1, plus listed versions 0.18.5 |
0.18.5-tuxcare.1 |
xlsxnpm |
All versions | None known |
@rootio/xlsxRoot:npm |
before 0.18.5-root.io.1 | 0.18.5-root.io.1 |
xlsxRoot:npm |
before 0.18.5-aikido.1 | 0.18.5-aikido.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | weareu/xlsx | 2026-02-19 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-22363 is a high vulnerability (CVSS 7.5) in Sheetjs Community Edition, published April 5, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in xlsx 0.20.2.