There is no check that number is number. This creates a security issue

[nicklassigurdh]

There is no validation If you have a string as your value for a type number.
This makes it possible to insert xml and create a XML-injection attack

Example:

data: [
        {
            value: 'before</v></c><c r="B1"><f>=cmd|\'/C calc\'!A0</f><v>1</v></c><c r="C1"><v>after',
            type: 'number'
          }]
      ]