CVE-2018-16459: Exceljs Project Exceljs

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.

Affected products

• Exceljs Project Exceljs: before 1.6 (fixed in 1.6)

Published 2018-09-06. Last modified 2026-06-17.