Vulnerabilities CVE-2026-78209

CVE-2026-78209

High

Open

TLP:CLEAR

exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

Details

CVSS Score: 8.4
CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Confidence: 90%
Published: Aug 24, 2026
Last Modified: Aug 24, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.