CVE-2026-128348

MEDIUM 4.2

ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names

CVSS Score

4.2

EPSS Score

0.0%

EPSS Percentile

0th

ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.

CWE	CWE-116
Vendor	exceljs
Product	exceljs
Published	Nov 13, 2026

Stay Ahead of the Next One

Get instant alerts for exceljs exceljs

Be the first to know when new medium vulnerabilities affecting exceljs exceljs are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Affected Versions

exceljs / exceljs

0 ≤ 4.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/exceljs/exceljs github.com: https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v github.com: https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104 vulncheck.com: https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names

Credits

Matéo Florian Callec