CVE-2026-78209

Publié : 24 août 2026

Modifié : 24 août 2026

Score CVSS

8.2

HIGH

Description détaillée

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Références et Patchs

https://github.com/exceljs/exceljs https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182 https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-values

Dernières Vulnérabilités

CVE-2026-78213

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.

VOIR DÉTAILS

CVE-2026-78212

4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.

VOIR DÉTAILS

CVE-2026-78211

4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary system commands on the server.

VOIR DÉTAILS