CVE-2026-128345

ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared-formula.js when translating shared formulas to child cells. Attackers can supply a crafted spreadsheet with very long master formulas, such as runs of hyphens, causing quadratic...

CVE-2026-128348

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2026-128347

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any fi...

CVE-2026-128346

ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workbooks with worksheets placed before...

CVE-2026-128339

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet.parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, causing xlsx.load to create billions of...

CVE-2026-128338

exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load to allocate hundreds of millions of Colu...

CVE-2026-128342

ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk stall worksheets, getWorksheet and...

CVE-2026-128341

ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to make xlsx.load iterate billions of...

CVE-2026-128344

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/drawing1.xml so reading getImages...

CVE-2026-128340

ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell by cell, causing an uncatchable fatal...

CVE-2026-128343

exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making getSheetValues, workbook writes and...

CVE-2026-128337

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load, sets properties such as type, direction,...

CVE-2026-128336

ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to writ...

CVE-2026-128336

The ExcelJS library (through version 4.4.0 ) is vulnerable to a prototype pollution vulnerability. An attacker can supply a crafted xlsx file where the xl/workbook.xml definedName range targets proto . When workbook.xlsx.load() is executed, the CellMatrix component writes empty arrays onto Object...

EUVD-2026-125041

ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to writ...

EUVD-2026-125040

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load, sets properties such as type, direction,...

EUVD-2026-125039

exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load to allocate hundreds of millions of Colu...

CVE-2026-128338

The exceljs library (through version 4.4.0 ) is vulnerable to a memory exhaustion issue. An attacker can crash applications by providing a worksheet col element containing an unbounded max attribute . When processing such a workbook, the xlsx.load() function attempts to allocate hundreds of milli...

CVE-2026-128337

Versions of ExcelJS through 4.4.0 are vulnerable to a prototype pollution vulnerability in the mergeConditionalFormattings function. An attacker can exploit this by supplying an x14:cfRule id of __proto__. By crafting a malicious .xlsx file and loading it via xlsx.load(), an attacker can modify O...

CVE-2026-128339

The ExcelJS library (through version 4.4.0 ) is vulnerable to a memory exhaustion issue within the Worksheet._parseMergeCells function. An attacker can crash an application by providing a workbook containing an unbounded mergeCell range , such as A1:XFD1048576. When xlsx.load() processes this fil...