Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-w4tm-cqgm-2uey
Vulnerability ID VCID-w4tm-cqgm-2uey
Aliases CVE-2018-16459
GHSA-2j2j-8rrv-264g
Summary Cross-Site Scripting in exceljs
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00174 https://api.first.org/data/v1/epss?cve=CVE-2018-16459
epss 0.00174 https://api.first.org/data/v1/epss?cve=CVE-2018-16459
epss 0.00174 https://api.first.org/data/v1/epss?cve=CVE-2018-16459
cvssv3.1 6.1 https://github.com/advisories/GHSA-2j2j-8rrv-264g
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-2j2j-8rrv-264g
generic_textual MODERATE https://github.com/advisories/GHSA-2j2j-8rrv-264g
cvssv3 6.8 https://github.com/nodejs/security-wg/blob/main/vuln/npm/464.json
cvssv3.1 6.1 https://github.com/nodejs/security-wg/blob/master/vuln/npm/464.json
generic_textual MODERATE https://github.com/nodejs/security-wg/blob/master/vuln/npm/464.json
cvssv3 6.8 https://hackerone.com/reports/356809
cvssv3.1 6.1 https://hackerone.com/reports/356809
generic_textual MODERATE https://hackerone.com/reports/356809
cvssv3.1 6.1 https://nvd.nist.gov/vuln/detail/CVE-2018-16459
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2018-16459
cvssv3.1 6.1 https://www.npmjs.com/advisories/733
generic_textual MODERATE https://www.npmjs.com/advisories/733
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2018-16459
https://github.com/nodejs/security-wg/blob/master/vuln/npm/464.json
https://hackerone.com/reports/356809
https://www.npmjs.com/advisories/733
464 https://github.com/nodejs/security-wg/blob/main/vuln/npm/464.json
CVE-2018-16459 https://nvd.nist.gov/vuln/detail/CVE-2018-16459
GHSA-2j2j-8rrv-264g https://github.com/advisories/GHSA-2j2j-8rrv-264g
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/advisories/GHSA-2j2j-8rrv-264g
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://github.com/nodejs/security-wg/blob/master/vuln/npm/464.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://hackerone.com/reports/356809
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2018-16459
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Found at https://www.npmjs.com/advisories/733
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.3864
EPSS Score 0.00174
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:24:16.200820+00:00 GHSA Importer Import https://github.com/advisories/GHSA-2j2j-8rrv-264g 38.6.0