{"id":"CVE-2024-22363","aliases":["CLSA-2026-1771978233","EUVD-2024-1106","GHSA-5pgg-2g8v-p4x9","ROOT-APP-NPM-CVE-2024-22363"],"status":"published","title":"SheetJS Regular Expression Denial of Service (ReDoS)","description":"SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00843,"percentile":0.5838,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-1333"],"published":"2024-04-05T00:00:00Z","modified":"2026-10-15T09:47:45Z","exploits":[{"source":"pocgithub","id":"weareu/xlsx","title":"weareu/xlsx","date":"2026-02-19","url":"https://github.com/weareu/xlsx"}],"fixes":[{"ecosystem":"npm","package":"xlsx","fixed_in":["0.20.2"],"sources":["ghsa"]},{"ecosystem":"Root:npm","package":"@rootio/xlsx","fixed_in":["0.18.5-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"xlsx","fixed_in":["0.18.5-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"xlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.20.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"xlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.5-tuxcare.0"},{"fixed":"0.18.5-tuxcare.1"}]}],"versions":["0.18.5"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"xlsx","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/xlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"xlsx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.18.5-aikido.1"}]}]}],"products":[{"vendor":"sheetjs","product":"community_edition"}],"references":[{"url":"https://cwe.mitre.org/data/definitions/1333.html","tags":["x_transferred","web"]},{"url":"https://git.sheetjs.com/sheetjs/sheetjs/src/tag/v0.20.2","tags":["x_transferred","web"]},{"url":"https://cdn.sheetjs.com/advisories/CVE-2024-22363","tags":["x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22363","tags":["advisory"]},{"url":"https://cdn.sheetjs.com","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5pgg-2g8v-p4x9"},{"url":"https://git.sheetjs.com/sheetjs/sheetjs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-22363","description":"SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).","status":"published","published":"2024-04-05T00:00:00Z","modified":"2024-08-26T20:17:06.904Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:34:00.254134Z"}],"euvd":[{"id":"EUVD-2024-1106","description":"SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).","status":"published","published":"2024-04-05T00:00:00Z","modified":"2024-08-26T20:17:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:10.956482Z"}],"ghsa":[{"id":"GHSA-5pgg-2g8v-p4x9","title":"SheetJS Regular Expression Denial of Service (ReDoS)","description":"SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).\n\nA non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.","status":"published","published":"2024-04-05T06:30:46Z","modified":"2025-09-19T15:23:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:38:58.107905Z"}],"nvd":[{"id":"CVE-2024-22363","description":"SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).","status":"published","published":"2024-04-05T06:15:10.2Z","modified":"2026-06-17T07:11:15.44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"GHSA-5pgg-2g8v-p4x9","title":"SheetJS Regular Expression Denial of Service (ReDoS)","description":"SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).\n\nA non-vulnerable version cannot be found via npm, as the repository hosted on GitHub and the npm package `xlsx` are no longer maintained. Version 0.20.2 can be downloaded via https://cdn.sheetjs.com/.","status":"published","published":"2024-04-05T06:30:46Z","modified":"2026-09-10T03:49:18.872216794Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"CLSA-2026-1771978233","title":"TuxCare security update for xlsx (2 CVEs)","description":"TuxCare rebuilt xlsx to address 2 CVEs. Fixed in 0.18.5-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-15T09:47:45.934535932Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"ROOT-APP-NPM-CVE-2024-22363","title":"CVE-2024-22363 in @rootio/xlsx - Patched by Root","description":"Root has patched CVE-2024-22363 in the @rootio/xlsx package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-09T06:58:13Z","modified":"2026-07-09T14:00:26.704573592Z","updated_at":"2026-11-02T15:53:27.362922Z"}]}}