CVE-2023-30533
Sheetjs ≤ 0.19.3
Raw vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). EPSS scores by FIRST (EPSS SIG), generated by Empirical Security. Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-30533 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Sheetjs. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 38% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
SheetJS Community Edition before version 0.19.3 is affected by a prototype pollution vulnerability, tracked as CVE-2023-30533 and assigned CWE-1321. The flaw allows an attacker to supply a specially crafted spreadsheet file that, when parsed by the library, pollutes JavaScript object prototypes. The issue is present in all releases through 0.19.2 and was corrected in 0.19.3.
An attacker can exploit the vulnerability by delivering a malicious file to a victim who then opens it with an application that uses the vulnerable SheetJS library. Because the CVSS vector indicates local access, no privileges, and required user interaction, successful exploitation can result in arbitrary code execution or other impacts that affect confidentiality, integrity, and availability.
The vendor advisory at cdn.sheetjs.com and the project changelog both recommend upgrading to SheetJS Community Edition 0.19.3 or later. The associated Git repository issue and commit history confirm that the prototype-pollution vectors were removed in that release.
The EPSS score has remained flat at 0.0880 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1194
Vulnerability Data
SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file. In other words. 0.19.2 and earlier are affected, whereas 0.19.3 and later are unaffected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches prototype-pollution flaws before release.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.