---
id: "CVE-2026-128348"
page: "https://infrastack.ai/live/CVE-2026-128348"
kind: "vulnerability"
aliases: ["CVE-2026-128348"]
title: "ExcelJS: unescaped column names let spreadsheet formulas exfiltrate cell values"
severity: "medium"
cvss: 4.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["exceljs", "node", "package", "spreadsheet-export"]
not_affected_if: ["fixed-column-names", "no-totals-row"]
published_at: "2026-11-13T10:18:15+00:00"
first_seen_at: "2026-11-13T10:47:35+00:00"
updated_at: "2026-11-13T10:58:53+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-128348", "first_seen_at": "2026-11-13T10:47:35+00:00"}]
exploit_sources: []
---

# ExcelJS: unescaped column names let spreadsheet formulas exfiltrate cell values

Link for people: https://infrastack.ai/live/CVE-2026-128348 (this .md is for agents)

ExcelJS through 4.4.0 does not escape special characters in structured reference column names when writing totals row formulas. An attacker who controls column headers, such as imported CSV headers, can inject formulas like HYPERLINK that leak cell values when a user opens and clicks the generated workbook.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version with `npm ls exceljs`
- Look for code that builds workbooks with totals rows (`table.js` totals row, `totalsRow`) from untrusted header names

## Fix

- ExcelJS: unknown (sources do not state a fixed version)

## Timeline

- 2026-11-13T10:47:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-128348

## Documents

- [advisory] Vendor advisory: github.com https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names

## From the sources

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_