CVE-2022-23640: Improper Restriction of XML External Entity Reference in Excel-Streaming-Reader

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-03-02 · updated 2026-06-17
Weakness: CWE-611

Description

Excel-Streaming-Reader is an easy-to-use implementation of a streaming Excel reader using Apache POI. Prior to xlsx-streamer 2.1.0, the XML parser that was used did apply all the necessary settings to prevent XML Entity Expansion issues. Upgrade to version 2.1.0 to receive a patch. There is no known workaround.

Affected products

monitorjbl excel-streaming-reader: before 2.1.0 — fixed in 2.1.0

How to fix

Upgrade to a fixed version: monitorjbl excel-streaming-reader 2.1.0. Check the vendor advisory for mitigations.

References

https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73
https://github.com/monitorjbl/excel-streaming-reader/security/advisories/GHSA-xvm2-9xvc-hx7f
https://github.com/monitorjbl/excel-streaming-reader/commit/0749c7b9709db078ccdeada16d46a34bc2910c73
https://github.com/monitorjbl/excel-streaming-reader/security/advisories/GHSA-xvm2-9xvc-hx7f

Get alerted when CVE-2022-23640 or the next vulnerability affects your stack