Exceljs vulnerabilities
We track 14 vulnerabilities in Exceljs products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on November 13, 2026.
Latest Exceljs vulnerabilities
- 7.5 High severity
exceljs: External Control of File Name or Path
ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image pa
- 7.5 High severity
exceljs: Incomplete Cleanup
ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves temporary files and open descriptors when sheet parsing fails or iteration stops early. Attackers can repeatedly upload malformed multi-sheet workboo
- 7.5 High severity
exceljs: Allocation of Resources Without Limits or Throttling
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an unbounded image anchor column in the drawing part. Attackers can set an anchor column such as 300000000 in xl/drawings/
- 7.5 High severity
exceljs: Unchecked Input for Loop Condition
exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying unbounded row r attributes parsed in row-xform.js. Attackers can craft an XLSX file with a row numbered far beyond Excel's limit, making
- 7.5 High severity
exceljs: Unchecked Input for Loop Condition
ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by supplying an unbounded sheetId in xl/workbook.xml. Attackers can provide a workbook with a huge sheetId, making the sparse worksheet array walk st
- 7.5 High severity
exceljs: Allocation of Resources Without Limits or Throttling
ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers to exhaust CPU and memory by supplying unbounded sqref ranges. Attackers can provide a small crafted workbook with a sqref of A1:XFD1048576 to
- 7.5 High severity
exceljs: Allocation of Resources Without Limits or Throttling
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell b
- 7.5 High severity
exceljs: Allocation of Resources Without Limits or Throttling
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, ca
- 7.5 High severity
exceljs: Allocation of Resources Without Limits or Throttling
exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a worksheet col element with an unbounded max attribute. Attackers can craft a small workbook with a huge max value, causing xlsx.load() t
- 7.0 High severity
exceljs: Improperly Controlled Modification of Object Prototype Attributes
ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of __proto__. Attackers can craft an xlsx file that, when loaded with xlsx.load(),
- 8.2 High severity
exceljs: Improper Neutralization of Formula Elements in a CSV File
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application,
- 7.5 High severity
exceljs: External Control of File Name or Path
exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated work
- 9.4 Critical severity
exceljs: Improperly Controlled Modification of Object Prototype Attributes
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell no
- 7.5 High severity
exceljs: Improper Handling of Highly Compressed Data (Data Amplification)
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available res