Vendors / exceljs Records 4 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 3
Exploited now exceljs records in CISA KEV No exceljs vulnerabilities are listed in CISA KEV.
Priority MEDIUM 49
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00603 · Published 2026-08-24 · No fix listed CWE-1321
Priority MEDIUM 45
exceljs through 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.0063 · Published 2026-08-24 · No fix listed CWE-409
Priority MEDIUM 44
exceljs through 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths.
CVSS 4.0 HIGH 8.7· Network · No auth · No interaction · EPSS 0.00508 · Published 2026-08-24 · No fix listed CWE-73
Priority LOW 37
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output.
CVSS 4.0 HIGH 8.4· Network · No auth · User interaction · EPSS 0.0041 · Published 2026-08-24 · No fix listed CWE-1236
Open these records in search → All records by CVSS severity
1 3 0 0 0
