CVE-2026-128347 · Package
NO FIX YET · SEE WHAT TO DO
ExcelJS, a Node.js library for writing Excel workbooks, has a path traversal flaw in its streaming WorkbookWriter. An attacker who controls image paths passed to addImage can use ../ segments to embed any file the Node.js process can read into the generated workbook.
first public Oct 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use ExcelJS's streaming WorkbookWriter and pass user-controlled image paths to addImage are exposed. Applications that only read workbooks, use fixed image paths, or do not use the streaming writer are less likely to be exposed. unknown whether other usage patterns are affected.
Not affected if fixed-image-paths, no-streaming-writer
Who cares exceljs, node.js, npm
npm ls exceljs.WorkbookWriter and addImage where the image path comes from user input.4.4.0 are affected; the sources do not name a fixed version, so check the vendor advisory.ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.