Facing vulnerability issues while using xlsx in package.json #3048

New Issue

Arunsanthoshh · 2024-01-04T10:20:03Z

Arunsanthoshh commented

2024-01-04 10:20:03 +00:00

Im using latest version for the xlsx package but still getting the vulnerability issue while running npm audit command.
Like this we are getting issue on the particular package

Im using latest version for the xlsx package but still getting the vulnerability issue while running npm audit command. ![image](/attachments/4a92ba9d-c2ce-49bd-9278-b0669eef5bf7) Like this we are getting issue on the particular package

image.png

88 KiB

sheetjs commented

2024-01-04 17:44:18 +00:00

The issue stems from react-excel-workbook, which is pulling a very old version of the dependency.

Please read the entire comment and let us know if the fix works. If the explanation makes sense, we will add it to the docs.

Diagnosis

In general, to identify the modules that pull xlsx, run npm why xlsx.

When the dependency is not overridden, it will not mention overridden. Scan the output for "from the root project" to see which dependencies you are using. For example, if you directly install react-excel-workbook, the message will show:

xlsx@0.10.9
node_modules/xlsx
  xlsx@"^0.10.3" from react-excel-workbook@0.0.4
  node_modules/react-excel-workbook
    react-excel-workbook@"^0.0.4" from the root project <-- `react-excel-workbook` was installed directly

If the dependency is overridden, lines will include overridden:

xlsx@0.20.1 overridden
node_modules/xlsx
  overridden xlsx@"https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz" (was "^0.10.3") from react-excel-workbook@0.0.4
  node_modules/react-excel-workbook
    react-excel-workbook@"^0.0.4" from the root project

Reproduction

To reproduce your issue, create a small project that uses react-excel-workbook:

mkdir issue3048
cd issue3048 
npm init -y
npm i --save react-excel-workbook

Using NodeJS v20.10.0 with npm v10.2.3, the audit shows issues with xlsx:

Audit output (click to show)

xlsx  *
Severity: high
Denial of Service in SheetJS Pro - https://github.com/advisories/GHSA-g973-978j-2c3p
Denial of Service in SheetJS Pro - https://github.com/advisories/GHSA-3x9f-74h4-2fqr
Denial of Service in SheetsJS Pro - https://github.com/advisories/GHSA-8vcr-vxm8-293m
Prototype Pollution in sheetJS - https://github.com/advisories/GHSA-4r6h-8v6p-xvw6
No fix available
node_modules/xlsx
  react-excel-workbook  *
  Depends on vulnerable versions of react
  Depends on vulnerable versions of xlsx
  node_modules/react-excel-workbook

Resolution

As explained in the documentation, you must specify an override to force react-excel-workbook to use the latest version:

Add the following section to your package.json:

  "overrides": {
    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz"
  }

For example, the starter project package.json should look like:

{
  "name": "issue3048",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "keywords": [],
  "author": "",
  "license": "ISC",
  "overrides": {
    "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz"
  },
  "dependencies": {
    "react-excel-workbook": "^0.0.4"
  }
}

Uninstall react-excel-workbook. Pass the --no-save flag to ensure the package.json is not changed:

npm rm --no-save react-excel-workbook

Reinstall the dependency:

npm i react-excel-workbook

This forces react-excel-workbook to use the overridden version. You can verify this by running npm why xlsx:

xlsx@0.20.1 overridden
node_modules/xlsx
  overridden xlsx@"https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz" (was "^0.10.3") from react-excel-workbook@0.0.4
  node_modules/react-excel-workbook
    react-excel-workbook@"^0.0.4" from the root project

The issue stems from `react-excel-workbook`, which is pulling a very old version of the dependency. Please read the entire comment and let us know if the fix works. If the explanation makes sense, we will add it to the docs. #### Diagnosis In general, to identify the modules that pull `xlsx`, run `npm why xlsx`. When the dependency is not overridden, it will not mention `overridden`. Scan the output for "from the root project" to see which dependencies you are using. For example, if you directly install `react-excel-workbook`, the message will show: ``` xlsx@0.10.9 node_modules/xlsx xlsx@"^0.10.3" from react-excel-workbook@0.0.4 node_modules/react-excel-workbook react-excel-workbook@"^0.0.4" from the root project <-- `react-excel-workbook` was installed directly ``` If the dependency is overridden, lines will include `overridden`: ``` xlsx@0.20.1 overridden node_modules/xlsx overridden xlsx@"https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz" (was "^0.10.3") from react-excel-workbook@0.0.4 node_modules/react-excel-workbook react-excel-workbook@"^0.0.4" from the root project ``` #### Reproduction To reproduce your issue, create a small project that uses `react-excel-workbook`: ```bash mkdir issue3048 cd issue3048 npm init -y npm i --save react-excel-workbook ``` Using NodeJS `v20.10.0` with npm `v10.2.3`, the audit shows issues with `xlsx`: <details><summary><b>Audit output</b> (click to show)</summary> ```bash xlsx * Severity: high Denial of Service in SheetJS Pro - https://github.com/advisories/GHSA-g973-978j-2c3p Denial of Service in SheetJS Pro - https://github.com/advisories/GHSA-3x9f-74h4-2fqr Denial of Service in SheetsJS Pro - https://github.com/advisories/GHSA-8vcr-vxm8-293m Prototype Pollution in sheetJS - https://github.com/advisories/GHSA-4r6h-8v6p-xvw6 No fix available node_modules/xlsx react-excel-workbook * Depends on vulnerable versions of react Depends on vulnerable versions of xlsx node_modules/react-excel-workbook ``` </details> #### Resolution As explained [in the documentation](https://docs.sheetjs.com/docs/getting-started/installation/nodejs#legacy-endpoints), you must specify an override to force `react-excel-workbook` to use the latest version: 1) Add the following section to your `package.json`: ``` "overrides": { "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz" } ``` For example, the starter project `package.json` should look like: ```json { "name": "issue3048", "version": "1.0.0", "description": "", "main": "index.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1" }, "keywords": [], "author": "", "license": "ISC", "overrides": { "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz" }, "dependencies": { "react-excel-workbook": "^0.0.4" } } ``` 2) Uninstall `react-excel-workbook`. Pass the `--no-save` flag to ensure the `package.json` is not changed: ```bash npm rm --no-save react-excel-workbook ``` 3) Reinstall the dependency: ```bash npm i react-excel-workbook ``` This forces `react-excel-workbook` to use the overridden version. You can verify this by running `npm why xlsx`: ``` xlsx@0.20.1 overridden node_modules/xlsx overridden xlsx@"https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz" (was "^0.10.3") from react-excel-workbook@0.0.4 node_modules/react-excel-workbook react-excel-workbook@"^0.0.4" from the root project ```

sheetjs closed this issue

2024-01-04 17:44:18 +00:00

Arunsanthoshh commented

2024-01-05 04:25:55 +00:00

Hello,

I followed your steps, But I couldn`t able to re install the above package by adding the CDN link in package.json. Find the SS below. The issue looks like below when I try to reinstall.

Hello, I followed your steps, But I couldn`t able to re install the above package by adding the CDN link in package.json. Find the SS below. The issue looks like below when I try to reinstall. ![image](/attachments/5c140a4a-7321-42c9-9aaf-46d0f25f06e5)

image.png

154 KiB

Arunsanthoshh reopened this issue

2024-01-05 04:25:56 +00:00

sheetjs commented

2024-01-05 04:35:25 +00:00

The error suggests a local npm configuration problem.

Instead of installing from the URL, try downloading and installing the package tarball: https://docs.sheetjs.com/docs/getting-started/installation/nodejs#vendoring

The error suggests a local npm configuration problem. Instead of installing from the URL, try downloading and installing the package tarball: https://docs.sheetjs.com/docs/getting-started/installation/nodejs#vendoring

Arunsanthoshh commented

2024-01-05 08:38:01 +00:00

Just installed the xlsx package but still it showing the 4 vulnerabilities.

Just installed the xlsx package but still it showing the 4 vulnerabilities. ![image](/attachments/dec6d885-0473-4300-bf12-77f6c2ce1436)

image.png

57 KiB

sheetjs commented

2024-01-05 10:29:46 +00:00

To use the vendored version:

download https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz and move the file to the root of your project (adding to any git repo)
install the tarball:

npm i --save file:xlsx-0.20.1.tgz

add the override to package.json:

  "overrides": {
    "xlsx": "file:xlsx-0.20.1.tgz"
  }

uninstall the dependency:

npm rm --no-save react-excel-workbook

reinstall the dependency:

npm i react-excel-workbook

It is important to uninstall the dependency and set the override before reinstalling. That will force the correct dependency resolution.

To use the vendored version: 1) download https://cdn.sheetjs.com/xlsx-0.20.1/xlsx-0.20.1.tgz and move the file to the root of your project (adding to any git repo) 2) install the tarball: ```bash npm i --save file:xlsx-0.20.1.tgz ``` 3) add the override to package.json: ```js "overrides": { "xlsx": "file:xlsx-0.20.1.tgz" } ``` 4) uninstall the dependency: ```bash npm rm --no-save react-excel-workbook ``` 5) reinstall the dependency: ```bash npm i react-excel-workbook ``` It is important to uninstall the dependency and set the override before reinstalling. That will force the correct dependency resolution.

sheetjs closed this issue

2024-01-05 10:29:47 +00:00

Sign in to join this conversation.