The vulnerability identified as CVE-2026-78209 affects exceljs-hardened versions prior to 5.0.0. These versions fail to sanitize cell values that begin with characters such as '=', '+', '-', or '@' when exporting to CSV format. This failure enables formula injection attacks, where malicious formulas embedded in CSV cells execute when the file is opened in compatible spreadsheet software. The CVSS 3.1 score of 8.2 reflects a high-severity issue with network attack vector, low attack complexity, no privileges required, user interaction needed, and significant confidentiality impact.

Successful exploitation can lead to execution of arbitrary spreadsheet formulas upon opening the CSV file, which may result in data exfiltration or other unauthorized actions within the spreadsheet environment. The vulnerability compromises confidentiality with limited integrity impact and no availability impact.

No official patch or fix is currently confirmed for this vulnerability. Users should check the vendor advisory for updates. Until a fix is available, avoid exporting untrusted or user-controlled data to CSV using vulnerable versions of exceljs-hardened. Consider sanitizing or neutralizing leading special characters in cell values before export to prevent formula injection.