CVE-2026-128337

EUVD-2026-125040
ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of __proto__. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts.
Prototype Pollution
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
7 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 39.18%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
exceljs_projectexceljs
𝑥
≤ 4.4.0
CNA
Common Weakness Enumeration
References
https://github.com/exceljs/exceljs
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/worksheet-xform.js#L34-L42
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/xlsx/xform/sheet/worksheet-xform.js#L55-L74
https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-86ch-m4gp-r5xf
https://www.vulncheck.com/advisories/exceljs-through-4.4.0-prototype-pollution-via-x14-conditional-formatting-rule-id