CVE-2026-78209
Received Received - Intake

ExcelJS CSV Formula Injection via Cell Value Manipulation

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78209
EUVD
EUVD-2026-64684

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
exceljs exceljs to 5.0.0 (exc)
exceljs-hardened exceljs From 5.0.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1236 The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects exceljs-hardened versions before 5.0.0. It fails to neutralize leading equals (=), plus (+), minus (-), or at (@) signs in cell values when writing to CSV output. Attackers can inject formulas into CSV files that execute when opened in spreadsheet software, potentially causing data exfiltration or other malicious actions.

Detection Guidance

To detect this vulnerability, inspect CSV files generated by exceljs or exceljs-hardened versions before 5.0.0 for cell values starting with =, +, -, or @. Check if these values are interpreted as formulas when opened in spreadsheet software like Excel or LibreOffice Calc.

Impact Analysis

If you export data containing user-controlled cell values to CSV using affected versions, attackers could craft malicious formulas. When you open the CSV in Excel or similar tools, these formulas may execute automatically, leading to unauthorized data access, command execution, or data exfiltration via functions like HYPERLINK or WEBSERVICE.

Compliance Impact

This vulnerability could lead to data breaches by enabling unauthorized data exfiltration or access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations using affected versions may face compliance violations, regulatory penalties, and reputational damage.

Mitigation Strategies

Upgrade to exceljs-hardened version 5.0.0 or later which automatically escapes formula-like strings. Alternatively, sanitize cell values before exporting to CSV by removing or neutralizing leading =, +, -, or @ characters. Avoid opening CSV exports directly in spreadsheet applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78209. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart