High severity8.2NVD Advisory· Published Aug 24, 2026· Updated Aug 31, 2026

CVE-2026-78209

Description

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Exceljs Project/Exceljsllm-fuzzy
Range: <=4.4.0

Patches

Vulnerability mechanics

References

github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.jsnvd
github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrwnvd
www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-valuesnvd

News mentions

No linked articles in our index yet.

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000