CVE-2026-128348

Name of the Vulnerable Software and Affected Versions ExcelJS versions prior to 4.4.1

Description A formula injection issue exists in the totals row formula getter within the lib/doc/table.js file. The software fails to properly escape the characters [, ], #, and ' in structured reference column names. An attacker can provide column names containing the ] character through untrusted input, such as imported CSV headers, to inject formulas like HYPERLINK. This can lead to the exfiltration of cell values when a user opens the generated workbook and clicks the link.

Recommendations Update ExcelJS to version 4.4.1 or later.