The exceljs-hardened library before version 5.0.0 contains a path traversal vulnerability (CWE-73) in the Workbook.addImage() function. The function does not properly validate file paths supplied by users, which can be exploited by attackers to read arbitrary files accessible to the Node.js process. This can lead to unauthorized disclosure of sensitive information by embedding such files into generated Excel workbooks. The vulnerability is tracked as CVE-2026-78208 and has a CVSS 3.1 base score of 7.5, indicating high severity. No known exploits in the wild have been reported, and no patch or remediation information is currently provided.

Successful exploitation allows an attacker to read arbitrary files on the system where the Node.js process runs, potentially exposing sensitive data by embedding it into Excel workbooks. This impacts confidentiality but does not affect integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using the Workbook.addImage() function with untrusted input or restrict file system permissions for the Node.js process to limit file access.