CVE-2018-16459

An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.

Score

CVSS 3.0 6.1 Medium

Status

Modified - support@hackerone.com

Published

2018-09-06

Last modified

2024-09-17

Weaknesses

CWE-79

Affected products

• Exceljs (Exceljs Project)
• Exceljs (Httpsgithub.comguyonroche)

References

• https://hackerone.com/reports/356809