You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Update to the [latest version (2.1.0)](https://search.maven.org/artifact/com.monitorjbl/xlsx-streamer/2.1.0/jar)**as soon as possible** to fix a critical vulnerability. The Xerxes XML parsing library that Excel Streaming Reader uses defaulted to allowing [entity expansion](https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Prevention_Cheat_Sheet), which could be exploited by an attacker to read arbitrary data from your system. The latest versions of Excel Streaming Reader do not allow this and will throw a `ParsingException` if a workbook contains an XML document with an entity declaration.
6
-
7
-
Many thanks to [Marc Wickenden](https://www.4armed.com/blog/excel-streaming-reader-vulnerability/) at 4Armed for finding this vulnerability and helping verify the patch!
3
+
Profiled with [](https://www.yourkit.com/java/profiler/)
0 commit comments