CVE-2026-78209CWE-1236

CVE-2026-78209

High · published August 24, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
8.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
EPSS
0.00410 · 34.1th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2026-08-24T05:16Z
References (4)
https://github.com/exceljs/exceljs · [email protected]https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182 · [email protected]https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw · [email protected]https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-values · [email protected]
EPSS history
Timeline
  • 24 AUG 00:30Z
    exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
    cvelistv5