---
id: "CVE-2026-128347"
page: "https://infrastack.ai/live/CVE-2026-128347"
kind: "vulnerability"
aliases: ["CVE-2026-128347"]
title: "ExcelJS: crafted image filenames let attackers read local files"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["exceljs", "node.js", "npm", "package"]
not_affected_if: ["fixed-image-paths", "no-streaming-writer"]
published_at: "2026-11-13T10:18:15+00:00"
first_seen_at: "2026-11-13T10:47:35+00:00"
updated_at: "2026-11-13T10:49:11+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128347", "first_seen_at": "2026-11-13T10:47:35+00:00"}]
exploit_sources: []
---

# ExcelJS: crafted image filenames let attackers read local files

Link for people: https://infrastack.ai/live/CVE-2026-128347 (this .md is for agents)

ExcelJS, a Node.js library for writing Excel workbooks, has a path traversal flaw in its streaming WorkbookWriter. An attacker who controls image paths passed to addImage can use ../ segments to embed any file the Node.js process can read into the generated workbook.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls exceljs`.
- Search your code for `WorkbookWriter` and `addImage` where the image path comes from user input.

## Fix

- Versions through `4.4.0` are affected; the sources do not name a fixed version, so check the vendor advisory.

## Timeline

- 2026-11-13T10:47:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128347

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename

## From the sources

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_