CVE-2026-78209: exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values
exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
exceljsto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using exceljs or exceljs-hardened to export attacker-influenced data to CSV are exposed. The payload is triggered when a recipient opens the generated CSV in a spreadsheet application.
What does an attacker need to exploit it?
An attacker needs the ability to influence cell values included in CSV exports. No authentication or special privileges are required by the vulnerability vector, but the victim must open the exported file.
Are default CSV exports affected?
Affected versions do not neutralize cell values beginning with =, +, -, or @ before writing them to CSV. A default export that includes such attacker-controlled values can therefore be affected.
What can be done if upgrading is not immediately possible?
Sanitize or escape untrusted cell values before CSV generation so values beginning with =, +, -, or @ cannot be interpreted as spreadsheet formulas. Treat all externally influenced export fields as untrusted.
How can I determine whether an export is vulnerable?
Review CSV export handling for attacker-influenced cell values and test whether values beginning with =, +, -, or @ are emitted without neutralization. exceljs-hardened versions before 5.0.0 are affected according to the advisory data.