{"id":"CVE-2026-128336","kind":"vulnerability","aliases":["CVE-2026-128336"],"related":[],"title":"ExcelJS: crafted spreadsheet pollutes JavaScript object prototype during load","description":"ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets __proto__, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs.","summary":"ExcelJS through 4.4.0 lets a crafted xlsx file with a __proto__ defined name add numeric keys to Object.prototype when the workbook is loaded. The pollution applies process-wide, so an attacker can alter behavior of the running Node.js application.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exceljs","node","nodejs","package"],"not_affected_if":["no-untrusted-xlsx","write-only-usage"],"how_to_check":"- Find the ExcelJS version in the project: `npm ls exceljs`\n- Check whether the installed version is `4.4.0` or earlier\n- Look for calls to `workbook.xlsx.load()` that process uploaded or external xlsx files","fix":"- ExcelJS: unknown (sources do not name a fixed version)","status":"open","published_at":"2026-11-13T10:18:13+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:55:09+00:00","updated_at":"2026-11-13T10:55:09+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:55:09Z","model":"claude-haiku-5-5","output":{"fix":"- ExcelJS: unknown (sources do not name a fixed version)","reach":"internet","title":"ExcelJS: crafted spreadsheet pollutes JavaScript object prototype during load","impact":"medium","summary":"ExcelJS through 4.4.0 lets a crafted xlsx file with a __proto__ defined name add numeric keys to Object.prototype when the workbook is loaded. The pollution applies process-wide, so an attacker can alter behavior of the running Node.js application.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node","nodejs"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Process-wide prototype pollution corrupts application object behavior","analyst_note":"Confirm the fixed ExcelJS version and any workaround from the GitHub advisory and the VulnCheck page linked in the sources.","how_to_check":"- Find the ExcelJS version in the project: `npm ls exceljs`\n- Check whether the installed version is `4.4.0` or earlier\n- Look for calls to `workbook.xlsx.load()` that process uploaded or external xlsx files","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-xlsx","write-only-usage"],"who_is_affected":"Applications that use ExcelJS through version 4.4.0 to parse xlsx files from untrusted sources, such as user uploads or external data feeds, are exposed. Projects that only write spreadsheets or only load files they produce themselves can likely skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4643,"output_tokens":585,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128336':12A,15A '-2026':11A,14A '4.4.0':22B,62C 'add':33B,72C 'allow':69C 'alter':53B 'appli':45B 'applic':59B 'array':102C 'attack':51B,70C,86C 'behavior':54B 'caus':97C 'cellmatrix':98C 'contain':63C 'craft':2A,25B,79C 'cve':10A,13A 'defin':31B,80C 'definednam':93C 'empti':101C 'excelj':1A,16B,20B,60C 'file':27B 'javascript':5A 'key':35B,74C 'let':23B 'load':9A,42B 'name':32B,81C 'node':17B 'node.js':58B 'nodej':18B 'numer':34B,73C 'object':6A 'object.prototype':37B,76C,104C 'onto':103C 'packag':19B 'pollut':4A,44B,66C 'process':47B,106C 'process-wid':46B,105C 'proto':30B,84C,96C 'prototyp':7A,65C 'rang':94C 'referenc':82C 'run':57B,110C 'sheet':85C 'spreadsheet':3A 'suppli':88C 'target':95C 'vulner':67C 'whose':91C 'wide':48B,107C 'workbook':40B 'workbook.xlsx.load':109C 'write':100C 'xl/workbook.xml':92C 'xlsx':26B,90C","nicknames":[],"mitigations":[],"who_affected":"Applications that use ExcelJS through version 4.4.0 to parse xlsx files from untrusted sources, such as user uploads or external data feeds, are exposed. Projects that only write spreadsheets or only load files they produce themselves can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exceljs","medium","node","nodejs","package"],"campaign_type":null,"search_a":"'-128336':12A,15A '-2026':11A,14A 'craft':2A 'cve':10A,13A 'excelj':1A 'javascript':5A 'load':9A 'object':6A 'pollut':4A 'prototyp':7A 'spreadsheet':3A","search_b":"'4.4.0':22B 'add':33B 'alter':53B 'appli':45B 'applic':59B 'attack':51B 'behavior':54B 'craft':25B 'defin':31B 'excelj':16B,20B 'file':27B 'key':35B 'let':23B 'load':42B 'name':32B 'node':17B 'node.js':58B 'nodej':18B 'numer':34B 'object.prototype':37B 'packag':19B 'pollut':44B 'process':47B 'process-wid':46B 'proto':30B 'run':57B 'wide':48B 'workbook':40B 'xlsx':26B","search_c":"'4.4.0':62C 'add':72C 'allow':69C 'array':102C 'attack':70C,86C 'caus':97C 'cellmatrix':98C 'contain':63C 'craft':79C 'defin':80C 'definednam':93C 'empti':101C 'excelj':60C 'key':74C 'name':81C 'numer':73C 'object.prototype':76C,104C 'onto':103C 'pollut':66C 'process':106C 'process-wid':105C 'proto':84C,96C 'prototyp':65C 'rang':94C 'referenc':82C 'run':110C 'sheet':85C 'suppli':88C 'target':95C 'vulner':67C 'whose':91C 'wide':107C 'workbook.xlsx.load':109C 'write':100C 'xl/workbook.xml':92C 'xlsx':90C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:00:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128336","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128336","severity":null,"published_at":"2026-11-13T10:18:13+00:00","modified_at":"2026-11-13T10:18:13+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null}],"documents":[{"id":145473,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-pwgq-2cgg-6ph9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:00:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145474,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-proto-defined-name","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}