CVE-2026-128337

Versions of ExcelJS through 4.4.0 are vulnerable to a prototype pollution vulnerability in the mergeConditionalFormattings function. An attacker can exploit this by supplying an x14:cfRule id of __proto__. By crafting a malicious .xlsx file and loading it via xlsx.load(), an attacker can modify O...