{"metadata": {"vulnerability": "CVE-2026-128347", "count": 10, "kinds": {"milestone": 3, "sighting": 2, "kev": 0, "other": 5}, "linked_omitted": 0}, "data": [{"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128347", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T01:20:43.575Z", "date_only": false, "value": "2026-11-13T01:20:43.575Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-128347", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-13T09:33:31.024Z", "date_only": false, "value": "2026-11-13T09:33:31.024Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-128347", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-13T09:33:31.024Z", "date_only": false, "value": "2026-11-13T09:33:31.024Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-128347", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-13T09:33:31.024Z", "date_only": false, "value": "2026-11-13T09:33:31.024Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128347", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-13T10:18:15Z", "date_only": false, "value": "2026-11-13T10:18:15Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-JF4H-9VF8-6GMP", "record": "GHSA-JF4H-9VF8-6GMP", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-13T10:39:25.709Z", "date_only": false, "value": "2026-11-13T10:39:25.709508Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117608701248148657", "record": "CVE-2026-128347", "field": "creation_timestamp", "uuid": "20debcbc-259c-4e50-bdaa-082d9f4aa498", "content": "CVE-2026-128347 ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.\nhttps://www.cve.org/CVERecord?id=CVE-2026-128347https://github.com/exceljs/exceljshttps://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename#exceljs#CVE_2026_128347#bot", "url": "https://infosec.exchange/users/cve/statuses/117608701248148657"}, {"timestamp": "2026-11-13T12:31:43Z", "date_only": false, "value": "2026-11-13T12:31:43Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-JF4H-9VF8-6GMP", "record": "GHSA-JF4H-9VF8-6GMP", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-13T12:31:43Z", "date_only": false, "value": "2026-11-13T12:31:43Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-JF4H-9VF8-6GMP", "record": "GHSA-JF4H-9VF8-6GMP", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-13T14:36:55.979Z", "date_only": false, "value": "2026-11-13T14:36:55.979189Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/2llkmghgtjrne", "record": "CVE-2026-128347", "field": "creation_timestamp", "uuid": "a2756806-cf19-4cf5-86f6-34ca36ba2abc", "content": "CVE-2026-128347 - ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename\nCVE ID : CVE-2026-128347\n \n Published : Nov. 13, 2026, 10:18 a.m. | 3\u00a0hours, 55\u00a0minutes ago\n \n Description : ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/2llkmghgtjrne"}], "metrics": {"as_of": "2026-11-13T14:49:46.997Z", "anchors": {"origin": {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128347", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128347", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2472586.997329, "hours": 686.8297214802777, "days": 28.61790506167824, "min_seconds": 2386186.997329, "max_seconds": 2472586.997329, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-16T00:00:00Z", "date_only": false, "value": "2026-10-16T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-128347", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-13T14:49:46.997Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}