{"id":"CVE-2023-30533","aliases":["CLSA-2026-1771978233","EUVD-2023-1194","GHSA-4r6h-8v6p-xvw6","ROOT-APP-NPM-CVE-2023-30533"],"status":"published","title":"Prototype Pollution in sheetJS","description":"SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00988,"percentile":0.62943,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1321"],"published":"2023-04-24T00:00:00Z","modified":"2026-10-15T09:47:45Z","exploits":[{"source":"pocgithub","id":"BenEdridge/CVE-2023-30533","title":"BenEdridge/CVE-2023-30533","date":"2023-08-09","url":"https://github.com/BenEdridge/CVE-2023-30533"},{"source":"pocgithub","id":"weareu/xlsx","title":"weareu/xlsx","date":"2026-02-19","url":"https://github.com/weareu/xlsx"}],"fixes":[{"ecosystem":"npm","package":"xlsx","fixed_in":["0.19.3"],"sources":["ghsa"]},{"ecosystem":"Root:npm","package":"@rootio/xlsx","fixed_in":["0.18.5-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"xlsx","fixed_in":["0.18.5-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"xlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.19.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"xlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.5-tuxcare.0"},{"fixed":"0.18.5-tuxcare.1"}]}],"versions":["0.18.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"xlsx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/xlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"xlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-aikido.1"}]}]}],"products":[{"vendor":"sheetjs","product":"sheetjs"}],"references":[{"url":"https://git.sheetjs.com/sheetjs/sheetjs/src/branch/master/CHANGELOG.md","tags":["x_transferred","Release Notes","web"]},{"url":"https://cdn.sheetjs.com/advisories/CVE-2023-30533","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://git.sheetjs.com/sheetjs/sheetjs/issues/2986","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-30533","tags":["advisory"]},{"url":"https://git.sheetjs.com/sheetjs/sheetjs/issues/2667","tags":["web"]},{"url":"https://cdn.sheetjs.com","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4r6h-8v6p-xvw6"},{"url":"https://git.sheetjs.com/sheetjs/sheetjs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-30533","description":"SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.","status":"published","published":"2023-04-24T00:00:00Z","modified":"2025-02-04T19:42:49.455Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:35:22.309324Z"}],"euvd":[{"id":"EUVD-2023-1194","description":"SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.","status":"published","published":"2023-04-24T00:00:00Z","modified":"2025-02-04T19:42:49Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:04:05.9572Z"}],"ghsa":[{"id":"GHSA-4r6h-8v6p-xvw6","title":"Prototype Pollution in sheetJS","description":"All versions of SheetJS CE through 0.19.2 are vulnerable to \"Prototype Pollution\" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.\n\nA non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.19.3 can be downloaded via https://cdn.sheetjs.com/.","status":"published","published":"2023-04-24T09:30:19Z","modified":"2025-09-19T15:23:41Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"nvd":[{"id":"CVE-2023-30533","description":"SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.","status":"published","published":"2023-04-24T08:15:07.217Z","modified":"2026-06-17T05:54:57.583Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:07:56.683259Z"}],"osv":[{"id":"GHSA-4r6h-8v6p-xvw6","title":"Prototype Pollution in sheetJS","description":"All versions of SheetJS CE through 0.19.2 are vulnerable to \"Prototype Pollution\" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.\n\nA non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.19.3 can be downloaded via https://cdn.sheetjs.com/.","status":"published","published":"2023-04-24T09:30:19Z","modified":"2025-09-19T15:23:40Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"CLSA-2026-1771978233","title":"TuxCare security update for xlsx (2 CVEs)","description":"TuxCare rebuilt xlsx to address 2 CVEs. Fixed in 0.18.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:45.934535932Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"ROOT-APP-NPM-CVE-2023-30533","title":"CVE-2023-30533 in @rootio/xlsx - Patched by Root","description":"Root has patched CVE-2023-30533 in the @rootio/xlsx package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-09T06:58:13Z","modified":"2026-07-09T14:00:30.905898841Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}