Skip to content
OpenAdvisories

Vendor

exceljs

4 known vulnerabilities.

Products

exceljs 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-78209

    exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

    exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application…

    exceljs exceljs
  • High 7.5
    CVE-2026-78208

    exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

    exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated wor…

    exceljs exceljs
  • High 7.5
    CVE-2026-78206

    exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression

    exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available re…

    exceljs exceljs