CVE-2022-25646

Cross-site Scripting (XSS)

Medium5.4EPSS 0.91%

Published: 30 Aug 2022
Updated: 16 Sept 2024
Reserved: 24 Feb 2022
Assigned by: snyk

Description

All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells.

Timeline

2022
24 Feb 2022
24 Feb 2022
ID reserved
By snyk
30 Aug 20226 months later
30 Aug 2022· 6 months later
Published
2024
16 Sept 20242 years later
16 Sept 2024· 2 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2022-25646, by who scored it
Scored by	CVSS	Score	Vector
snykCNA (assigner)	3.1	Medium5.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
NVDNVD · Modified	3.1	Medium6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.91% · top 40% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

Cross-site Scripting (XSS)
CWE-79 (opens in a new tab)All about CWE-79 and its CVEs

Affected products

x-data-spreadsheet
- affected < unspecified

Affected packages

From reviewed advisories of the GitHub Advisory Database.

npmx-data-spreadsheetGHSA-x5cw-843f-r366 (opens in a new tab)

References (3)

https://security.snyk.io/vuln/SNYK-JS-XDATASPREADSHEET-2430381 (opens in a new tab)x_refsource_MISCx_transferred
https://github.com/myliang/x-spreadsheet/issues/580 (opens in a new tab)x_refsource_MISCx_transferred
https://youtu.be/Ij-8VVKNh7U (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-25646](https://trackcve.app/badge/CVE-2022-25646.svg)](https://trackcve.app/cve/CVE-2022-25646)

Record last updated 16 Sept 2024, 16:14 UTC.