{"id":"CVE-2026-128337","kind":"vulnerability","aliases":["CVE-2026-128337"],"related":[],"title":"ExcelJS: crafted xlsx file pollutes Object.prototype when loaded","description":"ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of __proto__. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts.","summary":"ExcelJS through 4.4.0 has a prototype pollution flaw in mergeConditionalFormattings: an x14:cfRule id of __proto__ in an xlsx file lets the file write properties onto Object.prototype. An attacker who gets a team's app to load the crafted file can alter behavior of every object in that process until it restarts.","severity":"high","cvss":8.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exceljs","node.js","npm","package"],"not_affected_if":["no-untrusted-xlsx-input"],"how_to_check":"- Check the installed version with `npm ls exceljs` or the `exceljs` entry in `package-lock.json`.\n- Search the codebase for calls to `xlsx.load(` on files that users or external systems can supply.","fix":"- ExcelJS: unknown (the sources give no fixed version)","status":"open","published_at":"2026-11-13T10:18:13+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","triaged_at":"2026-11-13T10:51:03+00:00","updated_at":"2026-11-13T10:51:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:51:03Z","model":"claude-haiku-5-5","output":{"fix":"- ExcelJS: unknown (the sources give no fixed version)","reach":"internet","title":"ExcelJS: crafted xlsx file pollutes Object.prototype when loaded","impact":"high","summary":"ExcelJS through 4.4.0 has a prototype pollution flaw in mergeConditionalFormattings: an x14:cfRule id of __proto__ in an xlsx file lets the file write properties onto Object.prototype. An attacker who gets a team's app to load the crafted file can alter behavior of every object in that process until it restarts.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node.js","npm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Global object prototype altered, changing behavior of the whole process","analyst_note":"Confirm the fixed ExcelJS version from the GitHub advisory (github.com) and the VulnCheck page; check whether the bug needs any special option.","how_to_check":"- Check the installed version with `npm ls exceljs` or the `exceljs` entry in `package-lock.json`.\n- Search the codebase for calls to `xlsx.load(` on files that users or external systems can supply.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-xlsx-input"],"who_is_affected":"Applications that use ExcelJS through 4.4.0 to load xlsx files from untrusted sources, such as uploads or files fetched from external systems. Projects that only write xlsx files or only load files they generate themselves are less exposed. The sources do not say whether the flaw is reachable in every loading path.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000776,"input_tokens":4629,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128337':11A,14A '-2026':10A,13A '4.4.0':21B,73C 'allow':82C 'alter':60B 'app':53B 'attack':47B,83C,95C 'behavior':61B 'border':112C 'cfrule':31B,91C 'cfvo':114C 'contain':74C 'craft':2A,57B,97C 'cve':9A,12A 'direct':111C 'everi':63B,116C 'excelj':1A,15B,19B,71C 'file':4A,38B,41B,58B,100C 'flaw':26B 'get':49B 'id':32B,92C 'let':39B 'load':8A,55B,103C 'mergeconditionalformat':28B,80C 'modifi':85C 'node.js':16B 'npm':17B 'object':64B,117C 'object.prototype':6A,45B,86C 'onto':44B 'packag':18B 'pollut':5A,25B,77C 'process':67B,120C 'properti':43B,107C 'proto':34B,94C 'prototyp':24B,76C 'restart':70B,123C 'set':106C 'suppli':88C 'team':51B 'type':110C 'vulner':78C 'write':42B 'x14':30B,90C 'xlsx':3A,37B,99C 'xlsx.load':105C","nicknames":[],"mitigations":[],"who_affected":"Applications that use ExcelJS through 4.4.0 to load xlsx files from untrusted sources, such as uploads or files fetched from external systems. Projects that only write xlsx files or only load files they generate themselves are less exposed. The sources do not say whether the flaw is reachable in every loading path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exceljs","high","nodejs","npm","package"],"campaign_type":null,"search_a":"'-128337':11A,14A '-2026':10A,13A 'craft':2A 'cve':9A,12A 'excelj':1A 'file':4A 'load':8A 'object.prototype':6A 'pollut':5A 'xlsx':3A","search_b":"'4.4.0':21B 'alter':60B 'app':53B 'attack':47B 'behavior':61B 'cfrule':31B 'craft':57B 'everi':63B 'excelj':15B,19B 'file':38B,41B,58B 'flaw':26B 'get':49B 'id':32B 'let':39B 'load':55B 'mergeconditionalformat':28B 'node.js':16B 'npm':17B 'object':64B 'object.prototype':45B 'onto':44B 'packag':18B 'pollut':25B 'process':67B 'properti':43B 'proto':34B 'prototyp':24B 'restart':70B 'team':51B 'write':42B 'x14':30B 'xlsx':37B","search_c":"'4.4.0':73C 'allow':82C 'attack':83C,95C 'border':112C 'cfrule':91C 'cfvo':114C 'contain':74C 'craft':97C 'direct':111C 'everi':116C 'excelj':71C 'file':100C 'id':92C 'load':103C 'mergeconditionalformat':80C 'modifi':85C 'object':117C 'object.prototype':86C 'pollut':77C 'process':120C 'properti':107C 'proto':94C 'prototyp':76C 'restart':123C 'set':106C 'suppli':88C 'type':110C 'vulner':78C 'x14':90C 'xlsx':99C 'xlsx.load':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:05:09+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128337","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128337","severity":null,"published_at":"2026-11-13T10:18:13+00:00","modified_at":"2026-11-13T10:18:13+00:00","first_seen_at":"2026-11-13T10:47:34+00:00","fetched_at":"2026-11-13T10:47:34+00:00","note":null}],"documents":[{"id":145475,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-86ch-m4gp-r5xf","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:05:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145476,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-x14-conditional-formatting-rule-id","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}