CVE-2026-128348: ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names
ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using ExcelJS through 4.4.0 that build tables with totals rows and derive table column names from untrusted input, such as imported CSV headers, are exposed. The impact occurs when a user opens the generated workbook and clicks the injected formula content.
What must an attacker do to exploit it?
The attacker must be able to supply a table column name containing characters such as ] that break out of a structured reference. They can use this to inject a formula, for example a HYPERLINK formula, into the totals-row formula generated by ExcelJS.
Are workbooks affected merely by opening them?
The described exfiltration scenario requires the user to open the generated workbook and click the injected HYPERLINK content. The provided information does not indicate that opening the workbook alone triggers exfiltration.
What can be done before updating?
Do not use untrusted input directly as Excel table column names, particularly CSV headers. Validate or sanitize column names to prevent [, ], #, and ' characters from reaching the totals-row formula generation path.