CVE-2026-128337 · Package
NO FIX YET · SEE WHAT TO DO
ExcelJS through 4.4.0 has a prototype pollution flaw in mergeConditionalFormattings: an x14:cfRule id of __proto__ in an xlsx file lets the file write properties onto Object.prototype. An attacker who gets a team's app to load the crafted file can alter behavior of every object in that process until it restarts.
first public Oct 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use ExcelJS through 4.4.0 to load xlsx files from untrusted sources, such as uploads or files fetched from external systems. Projects that only write xlsx files or only load files they generate themselves are less exposed. The sources do not say whether the flaw is reachable in every loading path.
Not affected if no-untrusted-xlsx-input
Who cares exceljs, node.js, npm
npm ls exceljs or the exceljs entry in package-lock.json.xlsx.load( on files that users or external systems can supply.ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.