CVE-2026-78209

exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

8.4 High

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.41%Up 0.1 points since Aug 24, 2026

What each source reports

CVE List Score used 8.4

exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

Record: CVE-2026-78209
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

EUVDEUVD-2026-64684 8.4

Record: EUVD-2026-64684
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-4w2g-jrqm-g99q 8.4

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at...

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

Record: GHSA-4w2g-jrqm-g99q
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

NVD 8.4

Record: CVE-2026-78209
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 8.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Weakness: CWE-1236
Updated: 2026-11-02

OSV 8.4

exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

Record: CVE-2026-78209
CVSS 4.0: 8.4 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Weakness: CWE-1236
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	aliases, products, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-78209 is a high vulnerability (CVSS 8.4) in Exceljs, published August 24, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.