Vulnerability Description
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/exceljs/exceljs
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182
- https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4r
- https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-u
FAQ
What is CVE-2026-78209?
CVE-2026-78209 is a vulnerability with a CVSS score of 8.2 (HIGH). exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execu...
How severe is CVE-2026-78209?
CVE-2026-78209 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-78209?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.