Vulnerabilidades do Exceljs Exceljs

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Exceljs Exceljs: 4 registro(s), com versões afetadas e correções.

CVE-2026-78209 Alta · 8.2 CWE-1236 23/08/2026

exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

CVE-2026-78208 Alta · 7.5 CWE-73 23/08/2026

exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

CVE-2026-78207 Crítica · 9.4 CWE-1321 23/08/2026

exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

CVE-2026-78206 Alta · 7.5 CWE-409 23/08/2026

exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression

exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.