CSV Injection Affecting exceljs package, versions <5.0.0
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-EXCELJS-19234021
- published24 Aug 2026
- disclosed24 Aug 2026
- creditUnknown
Introduced: 24 Aug 2026
NewCVE-2026-78209 (opens in a new tab)How to fix?
Upgrade exceljs to version 5.0.0 or higher.
Overview
exceljs is a package to Read, manipulate and write spreadsheet data and styles to XLSX and JSON.
Affected versions of this package are vulnerable to CSV Injection through the CSV.write() process in lib/csv/csv.js. An attacker can trigger spreadsheet formula execution by supplying a cell value that begins with =, +, -, or @ and getting it exported through workbook.csv.write(), writeBuffer(), or writeFile(). When a victim opens the exported CSV in Excel or LibreOffice Calc, the injected value is treated as a live formula, enabling command execution tricks, external data fetches, or exfiltration of other cells in the spreadsheet.
Notes
- The vulnerability is still present in upstream
exceljs; an unofficial fork -exceljs-hardened, carries the out-of-tree hardening mentioned in the referenced advisory.
Workarounds
- Sanitize values yourself before calling
workbook.csv.write(): prefix any string beginning with=,+,-,@, tab, or CR with a single quote ('). This prevents spreadsheet applications from interpreting attacker-controlled cell data as live formulas when you open the CSV. - Avoid opening CSV exports of user-influenced data directly in a spreadsheet application. This prevents Excel or LibreOffice Calc from triggering formula execution on untrusted exports.