CVE-2026-128336 · Package
NO FIX YET · SEE WHAT TO DO
ExcelJS through 4.4.0 lets a crafted xlsx file with a __proto__ defined name add numeric keys to Object.prototype when the workbook is loaded. The pollution applies process-wide, so an attacker can alter behavior of the running Node.js application.
first public Oct 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use ExcelJS through version 4.4.0 to parse xlsx files from untrusted sources, such as user uploads or external data feeds, are exposed. Projects that only write spreadsheets or only load files they produce themselves can likely skip it.
Not affected if no-untrusted-xlsx, write-only-usage
Who cares exceljs, node, nodejs
npm ls exceljs4.4.0 or earlierworkbook.xlsx.load() that process uploaded or external xlsx filesExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.