{"id":"CVE-2026-128348","kind":"vulnerability","aliases":["CVE-2026-128348"],"related":[],"title":"ExcelJS: unescaped column names let spreadsheet formulas exfiltrate cell values","description":"ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.","summary":"ExcelJS through 4.4.0 does not escape special characters in structured reference column names when writing totals row formulas. An attacker who controls column headers, such as imported CSV headers, can inject formulas like HYPERLINK that leak cell values when a user opens and clicks the generated workbook.","severity":"medium","cvss":4.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exceljs","node","package","spreadsheet-export"],"not_affected_if":["fixed-column-names","no-totals-row"],"how_to_check":"- Check the installed version with `npm ls exceljs`\n- Look for code that builds workbooks with totals rows (`table.js` totals row, `totalsRow`) from untrusted header names","fix":"- ExcelJS: unknown (sources do not state a fixed version)","status":"open","published_at":"2026-11-13T10:18:15+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","triaged_at":"2026-11-13T10:58:53+00:00","updated_at":"2026-11-13T10:58:53+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T10:58:53Z","model":"claude-haiku-5-5","output":{"fix":"- ExcelJS: unknown (sources do not state a fixed version)","reach":"internet","title":"ExcelJS: unescaped column names let spreadsheet formulas exfiltrate cell values","impact":"medium","summary":"ExcelJS through 4.4.0 does not escape special characters in structured reference column names when writing totals row formulas. An attacker who controls column headers, such as imported CSV headers, can inject formulas like HYPERLINK that leak cell values when a user opens and clicks the generated workbook.","audience":"developers","category":"package","nicknames":[],"who_cares":["exceljs","node","spreadsheet-export"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Cell values leak to an external site via a crafted HYPERLINK formula.","analyst_note":"Confirm the fixed ExcelJS version and the vendor advisory on github.com (linked as Vendor advisory) before filling fix.","how_to_check":"- Check the installed version with `npm ls exceljs`\n- Look for code that builds workbooks with totals rows (`table.js` totals row, `totalsRow`) from untrusted header names","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-column-names","no-totals-row"],"who_is_affected":"Applications that use ExcelJS to generate Excel workbooks with totals rows, where column names come from users or imported files such as CSV headers. Exposure depends on whether untrusted input reaches those column names; the workbook recipient must also open and click the injected link. Applications that only write fixed column names are unlikely to be affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000771,"input_tokens":4625,"output_tokens":616,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-128348':13A,16A '-2026':12A,15A '4.4.0':25B,72C 'attack':42B,97C 'cell':9A,59B,118C 'charact':30B,91C 'click':66B,124C 'column':3A,34B,45B,95C,100C 'contain':73C,102C 'control':44B 'csv':50B,108C 'cve':11A,14A 'escap':28B,89C 'excelj':1A,17B,23B,70C 'exfiltr':8A,117C 'export':22B 'fail':87C 'formula':7A,40B,54B,75C,82C,112C 'generat':68B,126C 'getter':83C 'header':46B,51B,109C 'hyperlink':56B,115C 'import':49B,107C 'inject':53B,76C,111C 'input':105C 'leak':58B 'let':5A 'lib/doc/table.js':85C 'like':55B,106C 'name':4A,35B,96C,101C 'node':18B 'open':64B,122C 'packag':19B 'refer':33B,94C 'row':39B,81C 'special':29B 'spreadsheet':6A,21B 'spreadsheet-export':20B 'structur':32B,93C 'suppli':99C 'total':38B,80C 'unescap':2A 'untrust':104C 'user':63B,121C 'valu':10A,60B,119C 'via':103C 'vulner':77C 'workbook':69B,127C 'write':37B","nicknames":[],"mitigations":[],"who_affected":"Applications that use ExcelJS to generate Excel workbooks with totals rows, where column names come from users or imported files such as CSV headers. Exposure depends on whether untrusted input reaches those column names; the workbook recipient must also open and click the injected link. Applications that only write fixed column names are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exceljs","medium","node","package","spreadsheetexport"],"campaign_type":null,"search_a":"'-128348':13A,16A '-2026':12A,15A 'cell':9A 'column':3A 'cve':11A,14A 'excelj':1A 'exfiltr':8A 'formula':7A 'let':5A 'name':4A 'spreadsheet':6A 'unescap':2A 'valu':10A","search_b":"'4.4.0':25B 'attack':42B 'cell':59B 'charact':30B 'click':66B 'column':34B,45B 'control':44B 'csv':50B 'escap':28B 'excelj':17B,23B 'export':22B 'formula':40B,54B 'generat':68B 'header':46B,51B 'hyperlink':56B 'import':49B 'inject':53B 'leak':58B 'like':55B 'name':35B 'node':18B 'open':64B 'packag':19B 'refer':33B 'row':39B 'special':29B 'spreadsheet':21B 'spreadsheet-export':20B 'structur':32B 'total':38B 'user':63B 'valu':60B 'workbook':69B 'write':37B","search_c":"'4.4.0':72C 'attack':97C 'cell':118C 'charact':91C 'click':124C 'column':95C,100C 'contain':73C,102C 'csv':108C 'escap':89C 'excelj':70C 'exfiltr':117C 'fail':87C 'formula':75C,82C,112C 'generat':126C 'getter':83C 'header':109C 'hyperlink':115C 'import':107C 'inject':76C,111C 'input':105C 'lib/doc/table.js':85C 'like':106C 'name':96C,101C 'open':122C 'refer':94C 'row':81C 'structur':93C 'suppli':99C 'total':80C 'untrust':104C 'user':121C 'valu':119C 'via':103C 'vulner':77C 'workbook':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-16T16:06:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128348","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128348","severity":null,"published_at":"2026-11-13T10:18:15+00:00","modified_at":"2026-11-13T10:18:15+00:00","first_seen_at":"2026-11-13T10:47:35+00:00","fetched_at":"2026-11-13T10:47:35+00:00","note":null}],"documents":[{"id":145497,"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T16:06:48+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145498,"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}