{"id":"CVE-2026-128347","kind":"vulnerability","aliases":["CVE-2026-128347"],"related":[],"title":"ExcelJS: crafted image filenames let attackers read local files","description":"ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.","summary":"ExcelJS, a Node.js library for writing Excel workbooks, has a path traversal flaw in its streaming WorkbookWriter. An attacker who controls image paths passed to addImage can use ../ segments to embed any file the Node.js process can read into the generated workbook.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exceljs","node.js","npm","package"],"not_affected_if":["fixed-image-paths","no-streaming-writer"],"how_to_check":"- Check the installed version with `npm ls exceljs`.\n- Search your code for `WorkbookWriter` and `addImage` where the image path comes from user input.","fix":"- Versions through `4.4.0` are affected; the sources do not name a fixed version, so check the vendor advisory.","status":"open","published_at":"2026-11-13T10:18:15+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","triaged_at":"2026-11-13T10:49:11+00:00","updated_at":"2026-11-13T10:49:11+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T10:49:11Z","model":"claude-haiku-5-5","output":{"fix":"- Versions through `4.4.0` are affected; the sources do not name a fixed version, so check the vendor advisory.","reach":"internet","title":"ExcelJS: crafted image filenames let attackers read local files","impact":"high","summary":"ExcelJS, a Node.js library for writing Excel workbooks, has a path traversal flaw in its streaming WorkbookWriter. An attacker who controls image paths passed to addImage can use ../ segments to embed any file the Node.js process can read into the generated workbook.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node.js","npm"],"confidence":0.7,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local files readable by the Node.js process leak into workbooks","analyst_note":"Find the fixed ExcelJS version in the github.com vendor advisory and confirm the exposure conditions from the advisory text.","how_to_check":"- Check the installed version with `npm ls exceljs`.\n- Search your code for `WorkbookWriter` and `addImage` where the image path comes from user input.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-image-paths","no-streaming-writer"],"who_is_affected":"Applications that use ExcelJS's streaming WorkbookWriter and pass user-controlled image paths to addImage are exposed. Applications that only read workbooks, use fixed image paths, or do not use the streaming writer are less likely to be exposed. unknown whether other usage patterns are affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4624,"output_tokens":587,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-128347':12A,15A '-2026':11A,14A '4.4.0':64C 'addimag':45B,88C 'addmedia':101C 'allow':76C 'arbitrari':67C 'attack':6A,38B,77C,89C 'caus':100C 'contain':65C 'control':40B,97C 'craft':2A,84C 'cve':10A,13A 'emb':50B,103C 'excel':26B 'excelj':1A,16B,20B,62C 'file':9A,52B,68C,81C,105C 'filenam':4A,86C 'flaw':32B 'generat':60B,115C 'imag':3A,41B,85C,98C 'inject':91C 'let':5A 'librari':23B 'local':8A,80C 'node.js':17B,22B,54B,109C 'npm':18B 'packag':19B 'pass':43B 'path':30B,42B,92C,99C 'process':55B,110C 'read':7A,57B,69C,79C 'readabl':106C 'segment':48B,93C 'stream':35B,73C 'suppli':83C 'travers':31B 'use':47B 'user':96C 'user-control':95C 'vulner':70C 'workbook':27B,61B,116C 'workbookwrit':36B,74C 'write':25B 'xl/media':112C","nicknames":[],"mitigations":[],"who_affected":"Applications that use ExcelJS's streaming WorkbookWriter and pass user-controlled image paths to addImage are exposed. Applications that only read workbooks, use fixed image paths, or do not use the streaming writer are less likely to be exposed. unknown whether other usage patterns are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exceljs","high","nodejs","npm","package"],"campaign_type":null,"search_a":"'-128347':12A,15A '-2026':11A,14A 'attack':6A 'craft':2A 'cve':10A,13A 'excelj':1A 'file':9A 'filenam':4A 'imag':3A 'let':5A 'local':8A 'read':7A","search_b":"'addimag':45B 'attack':38B 'control':40B 'emb':50B 'excel':26B 'excelj':16B,20B 'file':52B 'flaw':32B 'generat':60B 'imag':41B 'librari':23B 'node.js':17B,22B,54B 'npm':18B 'packag':19B 'pass':43B 'path':30B,42B 'process':55B 'read':57B 'segment':48B 'stream':35B 'travers':31B 'use':47B 'workbook':27B,61B 'workbookwrit':36B 'write':25B","search_c":"'4.4.0':64C 'addimag':88C 'addmedia':101C 'allow':76C 'arbitrari':67C 'attack':77C,89C 'caus':100C 'contain':65C 'control':97C 'craft':84C 'emb':103C 'excelj':62C 'file':68C,81C,105C 'filenam':86C 'generat':115C 'imag':85C,98C 'inject':91C 'local':80C 'node.js':109C 'path':92C,99C 'process':110C 'read':69C,79C 'readabl':106C 'segment':93C 'stream':73C 'suppli':83C 'user':96C 'user-control':95C 'vulner':70C 'workbook':116C 'workbookwrit':74C 'xl/media':112C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:02:50+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128347","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128347","severity":null,"published_at":"2026-11-13T10:18:15+00:00","modified_at":"2026-11-13T10:18:15+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","fetched_at":"2026-11-13T10:47:35+00:00","note":null}],"documents":[{"id":145495,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:02:50+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145496,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}