Prototype Pollution

Overview org.webjars.npm:exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to Prototype Pollution through Note.model serialization in lib/utils/under-dash.js. An attacker can modify Object.prototype an...

Prototype Pollution

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to Prototype Pollution through Note.model serialization in lib/utils/under-dash.js. An attacker can modify Object.prototype and influence late...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution through Note.model serialization in lib/utils/under-dash.js. An attacker can modify Object.prototype and influence later plain-object behavior by supplying user-controlled JSON as cell.note with a proto property and...

External Control of File Name or Path

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImagefilename in lib/xlsx/xlsx.js addMedia. An attacker can read arbitrary files...

External Control of File Name or Path

Overview org.webjars.npm:exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImagefilename in lib/xlsx/xlsx.js addMedia. An attacker can read...

CSV Injection

Overview org.webjars.npm:exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImagefilename in lib/xlsx/xlsx.js addMedia. An attacker can read arbitrary files accessible to the Node.js process by supplying a filename fragment that escapes the intended base...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell value that begins with =, +, -, or @ and getting it exported through workbook.csv.write, writeBuffe...

CSV Injection

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell...

Improper Handling of Highly Compressed Data (Data Amplification)

Amendment This was deemed not a vulnerability. Overview org.webjars.npm:exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via Workbook.xlsx.load in lib/xlsx/xlsx.js. An attacker can exhaust memory a...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via Workbook.xlsx.load in lib/xlsx/xlsx.js. An attacker can exhaust memory and crash the process by supplying a highly compressible .xlsx file that expands into a very large...

CVE-2026-78208

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...

CVE-2026-78209

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...

CVE-2026-78207

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...

CVE-2026-78206

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service...

CVE-2026-78209 exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...

CVE-2026-78209 exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...

EUVD-2026-64684

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially...

CVE-2026-78209

exceljs-hardened versions before 5.0.0 are vulnerable to CSV formula injection . The library fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. An attacker who can influence exported cell values can inject spreadsheet formulas that execute when the ...