{"id":"CVE-2026-128348","aliases":[],"cve":{"records":[{"id":"CVE-2026-128348","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-13T01:20:43.948Z","published":"2026-11-13T09:33:30.358Z","modified":"2026-11-13T17:51:06.150Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-13T09:33:30.358Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-13T17:51:06.150Z"}],"references":[{"url":"https://github.com/exceljs/exceljs","tags":["product"],"source":"VulnCheck"},{"url":"https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v","tags":["third-party-advisory"],"source":"VulnCheck"},{"url":"https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104","tags":["technical-description"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-116","description":"Improper Encoding or Escaping of Output","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:exceljs_project:exceljs:*:*:*:*:*:*:*:*","versionEndIncluding":"4.4.0"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-13T17:50:31.305356Z","decisions":[{"name":"Exploitation","value":"poc"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.","score":4.2,"severity":"medium","published":"2026-11-13T09:33:30.358Z","modified":"2026-11-13T17:51:06.150Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"exceljs","name":"exceljs","platforms":[],"versions":[{"version":"0","status":"affected","lessThanOrEqual":"4.4.0","versionType":"semver"}],"defaultStatus":"unaffected","packageURL":"pkg:npm/exceljs","packageIdentity":{"ecosystem":"npm","name":"exceljs"},"cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-128348"}],"remediation":[],"references":["https://github.com/exceljs/exceljs","https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qjfh-3mh9-356v","https://github.com/exceljs/exceljs/blob/v4.4.0/lib/doc/table.js#L84-L104","https://www.vulncheck.com/advisories/exceljs-through-4.4.0-formula-injection-via-table-totals-row-column-names"],"sources":[{"name":"CVE","id":"CVE-2026-128348","modified":"2026-11-13T17:51:06.150Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-128348"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3},{"source":"VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","score":4.2}],"sourceAffected":[],"observedAt":"2026-11-13T17:58:22.352Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:20:33.177Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-13T18:00:31.925Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-13T18:00:32.582Z","attemptedAt":"2026-11-13T18:00:32.582Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-13T18:00:32.308Z","attemptedAt":"2026-11-13T18:00:32.308Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-13T18:00:31.799Z","attemptedAt":"2026-11-13T18:00:31.799Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-128348","url":"https://www.first.org/epss/","probability":0.00296,"percentile":0.22473,"date":"2026-11-13","checkedAt":"2026-11-13T18:00:31.799Z"},{"source":"ENISA EUVD","id":"EUVD-2026-125151","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-125151","modified":"Nov 13, 2026, 9:33:30 AM","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-13T18:00:32.308Z"},{"source":"GitHub Advisory Database","id":"GHSA-mc6q-q9x7-hr35","url":"https://github.com/advisories/GHSA-mc6q-q9x7-hr35","modified":"2026-11-13T12:31:43Z","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","checkedAt":"2026-11-13T18:00:32.582Z"}],"aiSummary":{"text":"ExcelJS through 4.4.0 has a formula injection vulnerability due to unescaped characters in table totals row column names, allowing attackers to inject formulas via untrusted input. The weakness is caused by improper encoding or escaping of output. Attackers can supply malicious column names to inject formulas.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-13T18:01:04.956Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-128348"}]}}