External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via Workbook.addImagefilename in lib/xlsx/xlsx.js addMedia. An attacker can read arbitrary files accessible to the Node.js process by supplying a filename fragment that escapes the intended base...

CSV Injection

Overview Affected versions of this package are vulnerable to CSV Injection through the CSV.write process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell value that begins with =, +, -, or @ and getting it exported through workbook.csv.write, writeBuffe...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via Workbook.xlsx.load in lib/xlsx/xlsx.js. An attacker can exhaust memory and crash the process by supplying a highly compressible .xlsx file that expands into a very large...

CVE-2026-78209

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or...

CVE-2026-78208

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...

CVE-2026-78207

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting...

CVE-2026-78206

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service...

EUVD-2026-64684

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially...

CVE-2026-78209

exceljs-hardened versions before 5.0.0 are vulnerable to CSV formula injection . The library fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. An attacker who can influence exported cell values can inject spreadsheet formulas that execute when the ...

CVE-2026-78208

exceljs-hardened before 5.0.0 (and exceljs through 4.4.0) is affected by a path traversal vulnerability in the Workbook.addImage() function. The function fails to validate file path inputs, allowing an attacker to supply an arbitrary path that reads any file accessible to the Node.js process and ...

CVE-2026-78207

exceljs-hardened before 5.0.0 (also tracked as exceljs through 4.4.0) contains a prototype pollution vulnerability in the deepMerge helper. The helper fails to reject __proto__, constructor, or prototype keys when merging note objects, allowing an attacker to assign parsed JSON with a malicious _...

EUVD-2026-64682

exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and...

EUVD-2026-64683

exceljs-hardened before 5.0.0 contains a path traversal vulnerability in the Workbook.addImage function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook...

EUVD-2026-64681

exceljs-hardened before 5.0.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of...

CVE-2026-78206 exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service...

CVE-2026-78206

exceljs-hardened before 5.0.0 (and the upstream exceljs through 4.4.0) is vulnerable to uncontrolled resource consumption via unbounded xlsx decompression. The library decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. ...

PT-2026-79800

Name of the Vulnerable Software and Affected Versions exceljs-hardened versions prior to 5.0.0 Description An issue exists in the deepMerge helper that fails to reject proto , constructor, or prototype keys when merging note objects. This allows attackers to assign parsed JSON containing a...

PT-2026-79799

Name of the Vulnerable Software and Affected Versions exceljs-hardened versions prior to 5.0.0 Description The software decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. This allows attackers to upload highly compresse...

PT-2026-79802

Name of the Vulnerable Software and Affected Versions exceljs-hardened versions prior to 5.0.0 Description Insufficient neutralization of leading equals =, plus +, minus -, or at @ signs in cell values written to CSV output allows for CSV Injection. This occurs when attackers influence exported...

PT-2026-79801

Name of the Vulnerable Software and Affected Versions exceljs-hardened versions prior to 5.0.0 Description A path traversal issue exists in the Workbook.addImage function due to insufficient validation of file paths. This allows an attacker to provide arbitrary file paths to read any file...