CVE-2026-128337: ExcelJS through 4.4.0 Prototype Pollution via x14 Conditional Formatting Rule ID
ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using ExcelJS through 4.4.0 are exposed if they load attacker-controlled or otherwise untrusted XLSX files with xlsx.load(). The malicious content is an x14 conditional-formatting rule whose id is __proto__.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied vector. Exploitation requires an attacker to cause the application to load a crafted XLSX file.
What is the impact after a malicious file is loaded?
The crafted rule can modify Object.prototype, causing properties including type, direction, border, and cfvo to appear on every object in the process. The pollution persists until the process restarts and can affect confidentiality, integrity, and availability.