# CVE-2026-78209: exceljs formula injection in CSV output

Source: https://junglewise.ai/threats/cve-2026-78209-exceljs-formula-injection-in-csv-output  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-78209 · Severity: high · CVSS 8.2 · Published 2026-08-24

exceljs is a popular JavaScript library for reading and writing Excel spreadsheets. When exporting data to CSV format, the library fails to sanitize cell values that start with special characters (=, +, -, @), allowing attackers to inject malicious formulas. If a user opens the resulting CSV file in Excel or similar applications, these formulas execute automatically, potentially compromising sensitive data or enabling further attacks.

## Quick answers

**Is CVE-2026-78209 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78209 being exploited in the wild.

**How severe is CVE-2026-78209?** High severity, with a CVSS score of 8.2, published 24 August 2026.

**Which products and versions are affected?** exceljs exceljs through 4.4.0.

**Is there a fix for CVE-2026-78209?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78209 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78209?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a formula injection flaw in exceljs through version 4.4.0. The library fails to neutralize leading equals, plus, minus, or at signs in cell values when writing CSV output. These characters trigger formula interpretation in spreadsheet applications. An attacker who can control or influence cell data exported via exceljs can craft payloads like "=cmd|'/c calc'!A1" that execute when the CSV is opened in Excel. The attack requires no special privileges beyond the ability to input data into cells that will be exported, and no user interaction beyond opening the CSV file. Patch availability should be verified against the exceljs repository.

## Affected products

- exceljs exceljs through 4.4.0

## Timeline

- 2026-08-24: disclosed

## References

- [https://www.npmjs.com/package/exceljs](https://www.npmjs.com/package/exceljs)
- [https://github.com/exceljs/exceljs](https://github.com/exceljs/exceljs)