---
id: CVE-2026-78209
title: >-
  exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at
  signs in cell values written to CSV output
summary: >-
  exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at
  signs in cell values written to CSV output. Attackers who can influence
  exported cell values can inject formulas that execute when the CSV file is
  opened in a s…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N'
cwe:
  - CWE-1236
published: '2026-08-24'
updated: '2026-08-29'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78209'
references:
  - url: 'https://github.com/exceljs/exceljs'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/exceljs/exceljs/blob/v4.4.0/lib/csv/csv.js#L109-L182'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-9wxc-4rhw-hfrw
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/exceljs-through-csv-formula-injection-via-unescaped-cell-values
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.0041
epssPercentile: 0.32411
ingestedAt: '2026-08-29T21:42:33.281Z'
---

## Overview

exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.