VULNERABILITY INTELLIGENCE
CVE-2026-78209
CVSS score8.2 HIGH
EPSS probability0.41%
CISA KEVNot currently listed
Published2026-08-24
Last modified2026-10-14
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Description
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.
Weakness classification
- disclosure@vulncheck.com: CWE-1236