Which versions of exceljs-hardened are affected by CVE-2026-78209?

exceljs-hardened before version 5.0.0 contains a CSV formula injection vulnerability affecting organizations that export user or external data to CSV format.

How to fix or mitigate CVE-2026-78209?

Within 24 hours, inventory all systems and applications using exceljs-hardened, prioritizing those generating CSV exports from user or external data sources, and document current versions and deployment scope. Within 7 days, implement input validation to strip or escape leading characters (=, +, -, @) from all cell values before CSV generation, conduct a retrospective review of previously exported files for formula injection artifacts, and assess customer and stakeholder risk from existing exports. Within 30 days, establish monitoring for exceljs-hardened security updates, evaluate upgrade feasibility to version 5.0.0 or later when available, and formalize compensating controls in data export policies.

exceljs-hardened CVE-2026-78209

Q: What is the CVSS score of CVE-2026-78209?

CVE-2026-78209 has a CVSS 4.0 base score of 8.4 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-64684 HIGH

Improper Neutralization of Formula Elements in a CSV File (CWE-1236)

2026-08-24 VulnCheck

GHSA-4w2g-jrqm-g99q

Code Injection Exceljs

8.4

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.4 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network delivery with no auth or complexity needed; user must open CSV (UI:R); scope changes to spreadsheet app executing the formula (S:C); high confidentiality, low integrity impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 01:05 vuln.today

CVE Published

Aug 24, 2026 - 00:30 cve.org

HIGH 8.4

DescriptionCVE.org

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

AnalysisAI

CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values to embed spreadsheet formulas in generated CSV output by supplying values beginning with =, +, -, or @. When a victim opens the resulting CSV in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, injected formulas execute in the spreadsheet context, enabling data exfiltration or unauthorized actions within that application. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality impact and a scope change to the subsequent spreadsheet application system.

Technical ContextAI

exceljs-hardened is a security-focused npm fork of the widely-used exceljs Node.js library, which provides Excel and CSV file generation capabilities. The flaw originates in the CSV serialization path, specifically identifiable at lib/csv/csv.js lines 109-182 of upstream exceljs v4.4.0 (https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182), where cell values are written to CSV output without checking for or neutralizing formula-trigger characters. CWE-1236 (Improper Neutralization of Formula Elements in a CSV File) precisely describes this root cause: spreadsheet applications interpret cell values beginning with =, +, -, or @ as formula directives rather than literal data, executing arbitrary expressions including network-connected functions like HYPERLINK or DDE. The CPE cpe:2.3:a:exceljs:exceljs:*:*:*:*:*:*:*:* identifies the upstream exceljs library as the origin of this code, underscoring that exceljs-hardened inherited the vulnerable implementation despite its security-hardening mandate.

RemediationAI

Upgrade exceljs-hardened to version 5.0.0 or later, which introduces proper neutralization of leading formula-trigger characters (=, +, -, @) in CSV cell values, as documented in the security advisory at https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw. If an immediate upgrade is not feasible, applications should sanitize all user-controlled string values before passing them to the CSV export function - specifically by prefixing any value beginning with =, +, -, or @ with a tab character or single quote to prevent formula interpretation; note that single-quote prefixing may be visible to end-users in some spreadsheet applications, which is an acceptable trade-off versus injection risk. As a defense-in-depth control, server-side input validation stripping or rejecting leading formula characters from text fields narrows the attack surface without requiring changes to the export layer, though this approach requires careful scoping to avoid breaking legitimate data such as phone numbers beginning with +. Do not rely on end-user education about opening CSV files as a compensating control.