CVE-2026-78209

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-78209", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-24T00:15:01.656Z", "datePublished": "2026-08-24T00:30:48.493Z", "dateUpdated": "2026-11-08T14:09:05.226Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:09:05.226Z"}, "datePublic": "2026-08-23T00:00:00.000Z", "title": "exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values", "descriptions": [{"lang": "en", "value": "exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Formula Elements in a CSV File", "cweId": "CWE-1236", "type": "CWE"}]}], "affected": [{"vendor": "exceljs", "product": "exceljs", "collectionURL": "https://www.npmjs.com/package/exceljs", "packageName": "exceljs", "packageURL": "pkg:npm/exceljs", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "4.4.0", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.4.0"}]}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/exceljs/exceljs", "tags": ["product"]}, {"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw", "name": "GitHub Security Advisory (GHSA-9wxc-4rhw-hfrw)", "tags": ["third-party-advisory", "vendor-advisory"]}, {"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-values"}], "credits": [{"lang": "en", "value": "Mat\u00e9o Florian Callec", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-24T18:02:14.458123Z", "id": "CVE-2026-78209", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T18:02:29.223Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-78209", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-24T18:02:14.458123Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-24T18:02:24.614Z"}}], "cna": {"title": "exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values", "credits": [{"lang": "en", "type": "finder", "value": "Mat\u00e9o Florian Callec"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "exceljs", "product": "exceljs", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.4.0"}], "packageURL": "pkg:npm/exceljs", "packageName": "exceljs", "collectionURL": "https://www.npmjs.com/package/exceljs", "defaultStatus": "unaffected"}], "datePublic": "2026-08-23T00:00:00.000Z", "references": [{"url": "https://github.com/exceljs/exceljs", "tags": ["product"]}, {"url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw", "name": "GitHub Security Advisory (GHSA-9wxc-4rhw-hfrw)", "tags": ["third-party-advisory", "vendor-advisory"]}, {"url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-values", "name": "VulnCheck Advisory: exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1236", "description": "Improper Neutralization of Formula Elements in a CSV File"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "4.4.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:09:05.226Z"}}}, "cveMetadata": {"cveId": "CVE-2026-78209", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:09:05.226Z", "dateReserved": "2026-08-24T00:15:01.656Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-24T00:30:48.493Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://www.npmjs.com/package/exceljs", "defaultStatus": "unaffected", "packageName": "exceljs", "packageURL": "pkg:npm/exceljs", "product": "exceljs", "vendor": "exceljs", "versions": [{"lessThanOrEqual": "4.4.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions."}, {"lang": "es", "value": "Las versiones de exceljs-hardened anteriores a la 5.0.0 fallan al neutralizar los signos iniciales de igual, m\u00e1s, menos o arroba en los valores de las celdas escritos en la salida CSV. Los atacantes que pueden influir en los valores de las celdas exportadas pueden inyectar f\u00f3rmulas que se ejecutan cuando el archivo CSV se abre en una aplicaci\u00f3n de hoja de c\u00e1lculo, exfiltrando datos potencialmente o realizando otras acciones maliciosas."}], "id": "CVE-2026-78209", "lastModified": "2026-10-14T13:10:00.187", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.7, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-78209", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-24T18:02:14.458123Z", "version": "2.0.3"}}]}, "published": "2026-08-24T01:16:58.423", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/exceljs/exceljs"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-values"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1236"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,4.4.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "exceljs", "source": "cna", "vendor": "exceljs"}, "product": "exceljs", "vendor": "exceljs"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,*]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "exceljs", "vendor": "exceljs_project"}], "created": "2026-08-24T01:30:04.791359+00:00", "updated": "2026-08-29T14:00:07.525054+00:00", "vendors": ["exceljs", "exceljs$PRODUCT$exceljs", "exceljs_project", "exceljs_project$PRODUCT$exceljs"]}