Executive brief
exceljs is a popular JavaScript library for reading and writing Excel spreadsheets. When exporting data to CSV format, the library fails to sanitize cell values that start with special characters (=, +, -, @), allowing attackers to inject malicious formulas. If a user opens the resulting CSV file in Excel or similar applications, these formulas execute automatically, potentially compromising sensitive data or enabling further attacks.
Technical details
The vulnerability is a formula injection flaw in exceljs through version 4.4.0. The library fails to neutralize leading equals, plus, minus, or at signs in cell values when writing CSV output. These characters trigger formula interpretation in spreadsheet applications. An attacker who can control or influence cell data exported via exceljs can craft payloads like "=cmd|'/c calc'!A1" that execute when the CSV is opened in Excel. The attack requires no special privileges beyond the ability to input data into cells that will be exported, and no user interaction beyond opening the CSV file. Patch availability should be verified against the exceljs repository.
Affected products
- exceljs exceljs through 4.4.0
Timeline
- 2026-08-24: disclosed