CVE-2026-128348

EUVD-2026-125151
ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
4.2 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 22.47%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
exceljs_projectexceljs
𝑥
≤ 4.4.0
CNA
Common Weakness Enumeration
References
https://github.com/exceljs/exceljs
https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104
https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v
https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names