CVE-2026-128337

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load, sets properties such as type, direction,...

EUVD-2026-125040

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load, sets properties such as type, direction,...

CVE-2026-128337

Versions of ExcelJS through 4.4.0 are vulnerable to a prototype pollution vulnerability in the mergeConditionalFormattings function. An attacker can exploit this by supplying an x14:cfRule id of __proto__. By crafting a malicious .xlsx file and loading it via xlsx.load(), an attacker can modify O...