CVE-2026-128348 · Package
NO FIX YET · SEE WHAT TO DO
ExcelJS through 4.4.0 does not escape special characters in structured reference column names when writing totals row formulas. An attacker who controls column headers, such as imported CSV headers, can inject formulas like HYPERLINK that leak cell values when a user opens and clicks the generated workbook.
first public Oct 16, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use ExcelJS to generate Excel workbooks with totals rows, where column names come from users or imported files such as CSV headers. Exposure depends on whether untrusted input reaches those column names; the workbook recipient must also open and click the injected link. Applications that only write fixed column names are unlikely to be affected.
Not affected if fixed-column-names, no-totals-row
Who cares exceljs, node, spreadsheet-export
npm ls exceljstable.js totals row, totalsRow) from untrusted header namesExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.