CVE-2026-128348
Received Received - Intake

Formula Injection in ExcelJS via Structured Reference Column Names

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128348
EUVD
EUVD-2026-125151

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
exceljs exceljs From 0 (inc) to 4.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ExcelJS through version 4.4.0 has a formula injection vulnerability in the totals row formula getter in lib/doc/table.js. It fails to escape special characters like [, ], #, and ' in structured reference column names. Attackers can inject malicious formulas such as HYPERLINK by supplying column names with these characters via untrusted input like CSV headers. When users open the workbook and click the injected content, cell values may be exfiltrated.

Detection Guidance

To detect this vulnerability, inspect ExcelJS-generated workbooks for suspicious column names containing unescaped characters like [, ], #, or '. Check CSV imports or user-provided data sources for such patterns. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows attackers to inject malicious formulas into Excel workbooks. If you open a workbook with crafted column names and click the injected content, it could exfiltrate sensitive cell values. The attack requires user interaction and is limited in impact but could lead to data leakage if untrusted files are opened.

Compliance Impact

This vulnerability could lead to unauthorized data exfiltration, potentially violating GDPR (data protection) or HIPAA (health data privacy) if sensitive information is leaked. Organizations using ExcelJS may need to patch systems to maintain compliance with data protection regulations.

Mitigation Strategies
  • Upgrade ExcelJS to version 4.4.1 or later to patch the vulnerability.
  • Validate and sanitize all column names from untrusted sources before processing.
  • Disable macros or formula execution in generated workbooks if possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128348. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...