CVE-2026-128348

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...

PT-2026-146562

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape , , and ' characters in structured reference column names. Attackers can supply column names containing via untrusted input like imported CSV headers to injec...