CVE-2026-128336: ExcelJS through 4.4.0 Prototype Pollution via __proto__ Defined Name
ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a proto sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets proto, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs.
Affected Software
Event History
Frequently Asked Questions
Which applications are exposed?
Applications using ExcelJS through 4.4.0 are exposed when they call workbook.xlsx.load() on an attacker-supplied XLSX file.
What does an attacker need to provide?
The attacker needs to supply a crafted XLSX containing a defined name in xl/workbook.xml whose range targets a sheet named __proto__.
How can affected processing be identified?
When the malicious workbook is loaded, CellMatrix writes empty arrays under numeric keys on Object.prototype. The pollution is process-wide for the running application process.