CVE-2026-128336
Received Received - Intake

Prototype Pollution in ExcelJS via Defined Name

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range targets __proto__, causing CellMatrix to write empty arrays onto Object.prototype process-wide when workbook.xlsx.load() runs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128336
EUVD
EUVD-2026-125041

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
exceljs exceljs From 0 (inc) to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ExcelJS through version 4.4.0 has a prototype pollution vulnerability. Attackers can create a malicious Excel file where a defined name references __proto__. When the file is loaded, it writes empty arrays onto Object.prototype process-wide, potentially altering JavaScript object behavior globally.

Detection Guidance

Detecting this vulnerability requires checking if ExcelJS versions 4.4.0 or below are installed in your system. Use commands like 'npm list exceljs' or 'npm ls exceljs' to verify the installed version. If the version is 4.4.0 or lower, the system is vulnerable.

Impact Analysis

This vulnerability can cause unintended behavior in applications using ExcelJS. It may break code that checks for key existence, disrupts for...in loops, or relies on absent keys. The impact affects all objects in the Node.js process until it restarts.

Mitigation Strategies

Immediately upgrade ExcelJS to version 4.4.1 or higher. Use 'npm update exceljs' or specify the latest version in your package.json. Additionally, validate all input files, especially .xlsx files, to prevent processing maliciously crafted spreadsheets.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128336. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...