Dashboard / CVE-2026-78209

CVE-2026-78209

HIGH
MEDIUM Priority: 0.03 BB Relevance: 67/100
Published: 2026-08-24 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Auth Conf. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: None
UI: Passive
AT: None
VC: High
VI: Low
VA: None

Description

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
exceljs exceljs 0

References & Advisories (4)

Bug Bounty Relevance

67 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity

CVSS Score

8.4 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

EPSS — Exploitation Probability

0.41%
Raw Score 0.004100
Percentile 35.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00410
2026-11-12
0.00410
2026-11-10
0.00410
2026-11-09
0.00410
2026-11-08
0.00410

Intelligence Sources

mitre ref →

External Links