CVE-2026-128348

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2026-128348 ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

CVE-2026-128348

Versions of ExcelJS through 4.4.0 are vulnerable to a formula injection vulnerability in the totals row formula getter located in lib/doc/table.js. The root cause is the failure to escape characters such as [, ], #, and ' in structured reference column names. An attacker can provide untrusted inp...

EUVD-2026-125151

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...