Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities found for exceljs by exceljs
CVE-2026-78209 (GCVE-0-2026-78209)
Vulnerability from nvd – Published: 2026-08-24 00:30 – Updated: 2026-08-29 11:47
VLAI
EPSS
VEX
Title
exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
Summary
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 18:02 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/exceljs/exceljs | product |
| https://github.com/mateocallec/exceljs-hardened/s… | third-party-advisory |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://www.vulncheck.com/advisories/exceljs-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T18:02:14.458123Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T18:02:29.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/exceljs",
"defaultStatus": "unaffected",
"packageName": "exceljs",
"packageURL": "pkg:npm/exceljs",
"product": "exceljs",
"vendor": "exceljs",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:47:59.263Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/exceljs/exceljs"
},
{
"name": "GitHub Security Advisory (GHSA-9wxc-4rhw-hfrw)",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182"
},
{
"name": "VulnCheck Advisory: exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-values"
}
],
"title": "exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78209",
"datePublished": "2026-08-24T00:30:48.493Z",
"dateReserved": "2026-08-24T00:15:01.656Z",
"dateUpdated": "2026-08-29T11:47:59.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78208 (GCVE-0-2026-78208)
Vulnerability from nvd – Published: 2026-08-24 00:30 – Updated: 2026-08-29 11:47
VLAI
EPSS
VEX
Title
exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
Summary
exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:58 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/exceljs/exceljs | product |
| https://github.com/mateocallec/exceljs-hardened/s… | third-party-advisory |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://www.vulncheck.com/advisories/exceljs-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T15:58:24.664489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T16:15:40.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/exceljs",
"defaultStatus": "unaffected",
"packageName": "exceljs",
"packageURL": "pkg:npm/exceljs",
"product": "exceljs",
"vendor": "exceljs",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:47:58.602Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/exceljs/exceljs"
},
{
"name": "GitHub Security Advisory (GHSA-m8mg-8574-gm3m)",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-m8mg-8574-gm3m"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L142-L147"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L421-L429"
},
{
"name": "VulnCheck Advisory: exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exceljs-through-path-traversal-via-unvalidated-addimage-filename"
}
],
"title": "exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78208",
"datePublished": "2026-08-24T00:30:47.795Z",
"dateReserved": "2026-08-24T00:15:01.656Z",
"dateUpdated": "2026-08-29T11:47:58.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78207 (GCVE-0-2026-78207)
Vulnerability from nvd – Published: 2026-08-24 00:30 – Updated: 2026-08-29 11:47
VLAI
EPSS
VEX
Title
exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
Summary
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 17:45 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/exceljs/exceljs | product |
| https://github.com/mateocallec/exceljs-hardened/s… | third-party-advisory |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://www.vulncheck.com/advisories/exceljs-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T17:45:28.866234Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T17:46:59.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/exceljs",
"defaultStatus": "unaffected",
"packageName": "exceljs",
"packageURL": "pkg:npm/exceljs",
"product": "exceljs",
"vendor": "exceljs",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:47:57.933Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/exceljs/exceljs"
},
{
"name": "GitHub Security Advisory (GHSA-qwr4-7h29-chpf)",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qwr4-7h29-chpf"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/under-dash.js#L155-L181"
},
{
"name": "VulnCheck Advisory: exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exceljs-through-prototype-pollution-via-deepmerge-reached-from-note-serialization"
}
],
"title": "exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78207",
"datePublished": "2026-08-24T00:30:47.125Z",
"dateReserved": "2026-08-24T00:15:01.656Z",
"dateUpdated": "2026-08-29T11:47:57.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78206 (GCVE-0-2026-78206)
Vulnerability from nvd – Published: 2026-08-24 00:30 – Updated: 2026-08-29 11:47
VLAI
EPSS
VEX
Title
exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
Summary
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 18:09 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/exceljs/exceljs | product |
| https://github.com/mateocallec/exceljs-hardened/s… | third-party-advisory |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://www.vulncheck.com/advisories/exceljs-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T18:09:41.294502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T18:09:57.395Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/exceljs",
"defaultStatus": "unaffected",
"packageName": "exceljs",
"packageURL": "pkg:npm/exceljs",
"product": "exceljs",
"vendor": "exceljs",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:47:57.243Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/exceljs/exceljs"
},
{
"name": "GitHub Security Advisory (GHSA-7cvf-3r55-r39q)",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-7cvf-3r55-r39q"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L257-L281"
},
{
"name": "VulnCheck Advisory: exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exceljs-through-uncontrolled-resource-consumption-via-unbounded-xlsx-decompression"
}
],
"title": "exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78206",
"datePublished": "2026-08-24T00:30:46.462Z",
"dateReserved": "2026-08-24T00:15:01.655Z",
"dateUpdated": "2026-08-29T11:47:57.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78209 (GCVE-0-2026-78209)
Vulnerability from cvelistv5 – Published: 2026-08-24 00:30 – Updated: 2026-08-29 11:47
VLAI
EPSS
VEX
Title
exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
Summary
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 18:02 UTC
CWE
- CWE-1236 - Improper Neutralization of Formula Elements in a CSV File
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/exceljs/exceljs | product |
| https://github.com/mateocallec/exceljs-hardened/s… | third-party-advisory |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://www.vulncheck.com/advisories/exceljs-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78209",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T18:02:14.458123Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T18:02:29.223Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/exceljs",
"defaultStatus": "unaffected",
"packageName": "exceljs",
"packageURL": "pkg:npm/exceljs",
"product": "exceljs",
"vendor": "exceljs",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "Improper Neutralization of Formula Elements in a CSV File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:47:59.263Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/exceljs/exceljs"
},
{
"name": "GitHub Security Advisory (GHSA-9wxc-4rhw-hfrw)",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182"
},
{
"name": "VulnCheck Advisory: exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-values"
}
],
"title": "exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78209",
"datePublished": "2026-08-24T00:30:48.493Z",
"dateReserved": "2026-08-24T00:15:01.656Z",
"dateUpdated": "2026-08-29T11:47:59.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78208 (GCVE-0-2026-78208)
Vulnerability from cvelistv5 – Published: 2026-08-24 00:30 – Updated: 2026-08-29 11:47
VLAI
EPSS
VEX
Title
exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename
Summary
exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:58 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/exceljs/exceljs | product |
| https://github.com/mateocallec/exceljs-hardened/s… | third-party-advisory |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://www.vulncheck.com/advisories/exceljs-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T15:58:24.664489Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T16:15:40.477Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/exceljs",
"defaultStatus": "unaffected",
"packageName": "exceljs",
"packageURL": "pkg:npm/exceljs",
"product": "exceljs",
"vendor": "exceljs",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:47:58.602Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/exceljs/exceljs"
},
{
"name": "GitHub Security Advisory (GHSA-m8mg-8574-gm3m)",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-m8mg-8574-gm3m"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/workbook.js#L142-L147"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L421-L429"
},
{
"name": "VulnCheck Advisory: exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exceljs-through-path-traversal-via-unvalidated-addimage-filename"
}
],
"title": "exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78208",
"datePublished": "2026-08-24T00:30:47.795Z",
"dateReserved": "2026-08-24T00:15:01.656Z",
"dateUpdated": "2026-08-29T11:47:58.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78207 (GCVE-0-2026-78207)
Vulnerability from cvelistv5 – Published: 2026-08-24 00:30 – Updated: 2026-08-29 11:47
VLAI
EPSS
VEX
Title
exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
Summary
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.
Severity
9.4 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-24 17:45 UTC
CWE
- CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/exceljs/exceljs | product |
| https://github.com/mateocallec/exceljs-hardened/s… | third-party-advisory |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://www.vulncheck.com/advisories/exceljs-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-24T17:45:28.866234Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-24T17:46:59.464Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/exceljs",
"defaultStatus": "unaffected",
"packageName": "exceljs",
"packageURL": "pkg:npm/exceljs",
"product": "exceljs",
"vendor": "exceljs",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1321",
"description": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:47:57.933Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/exceljs/exceljs"
},
{
"name": "GitHub Security Advisory (GHSA-qwr4-7h29-chpf)",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qwr4-7h29-chpf"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/under-dash.js#L155-L181"
},
{
"name": "VulnCheck Advisory: exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exceljs-through-prototype-pollution-via-deepmerge-reached-from-note-serialization"
}
],
"title": "exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78207",
"datePublished": "2026-08-24T00:30:47.125Z",
"dateReserved": "2026-08-24T00:15:01.656Z",
"dateUpdated": "2026-08-29T11:47:57.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78206 (GCVE-0-2026-78206)
Vulnerability from cvelistv5 – Published: 2026-08-24 00:30 – Updated: 2026-08-29 11:47
VLAI
EPSS
VEX
Title
exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression
Summary
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 18:09 UTC
CWE
- CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/exceljs/exceljs | product |
| https://github.com/mateocallec/exceljs-hardened/s… | third-party-advisory |
| https://github.com/exceljs/exceljs/blob/v4.4.0/li… | technical-description |
| https://www.vulncheck.com/advisories/exceljs-thro… | third-party-advisory |
Impacted products
Date Public
2026-08-23 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-78206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T18:09:41.294502Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T18:09:57.395Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.npmjs.com/package/exceljs",
"defaultStatus": "unaffected",
"packageName": "exceljs",
"packageURL": "pkg:npm/exceljs",
"product": "exceljs",
"vendor": "exceljs",
"versions": [
{
"lessThanOrEqual": "4.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mat\u00e9o Florian Callec"
}
],
"datePublic": "2026-08-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-409",
"description": "Improper Handling of Highly Compressed Data (Data Amplification)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T11:47:57.243Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"product"
],
"url": "https://github.com/exceljs/exceljs"
},
{
"name": "GitHub Security Advisory (GHSA-7cvf-3r55-r39q)",
"tags": [
"third-party-advisory"
],
"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-7cvf-3r55-r39q"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xlsx.js#L257-L281"
},
{
"name": "VulnCheck Advisory: exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/exceljs-through-uncontrolled-resource-consumption-via-unbounded-xlsx-decompression"
}
],
"title": "exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-78206",
"datePublished": "2026-08-24T00:30:46.462Z",
"dateReserved": "2026-08-24T00:15:01.655Z",
"dateUpdated": "2026-08-29T11:47:57.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}