CVE-2026-128347
EUVD-2026-12515213.11.2026, 10:18
ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.Enginsight
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources
(CNA/ADP records, vendor advisories, Enginsight analysis).
| Vendor | Product | Version | Source |
|---|---|---|---|
| exceljs_project | exceljs | 𝑥 ≤ 4.4.0 | CNA |
Common Weakness Enumeration
References