Threats affecting pkg:npm/exceljs

CVE-2026-78209 is a vulnerability in exceljs up to version 4.4.0 where leading formula characters (=, +, -, @) in CSV cell values are not neutralized. This allows attackers who control exported cell values to inject formulas that execute upon opening the CSV in spreadsheet software, potentially leading to data exfiltration or other malicious actions.

CVE-2026-78208 is a path traversal vulnerability in the exceljs library up to version 4.4.0. The flaw exists in the Workbook.addImage() function, which does not properly validate file paths. This allows attackers to supply arbitrary file paths, potentially reading any file accessible to the Node.js process and embedding its contents into the generated Excel workbook.

CVE-2026-78207 is a critical prototype pollution vulnerability in exceljs versions up to 4.4.0. The flaw exists in the deepMerge helper function, which improperly allows merging of objects containing __proto__, constructor, or prototype keys when processing cell notes. This enables attackers to modify Object.prototype, potentially impacting all plain objects created thereafter.

A vulnerability in exceljs up to version 4.4.0 allows attackers to upload highly compressed XLSX files that decompress into very large sizes in memory without limits. This can exhaust system resources and cause a denial of service.