Description

exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-24T01:16:58.423Z",
  "pubdate": "2026-08-24T01:16:58.423Z",
  "executiveSummary": "An improper neutralization of formula elements in CSV output exists within exceljs-hardened versions prior to 5.0.0. This vulnerability allows malicious actors who can influence exported cell values to perform CSV injection, also known as formula injection. When a vulnerable CSV file is opened in a spreadsheet application, the embedded formulas execute automatically, posing significant risks to data integrity and confidentiality.\nThe primary impact of successful exploitation includes potential data exfiltration, execution of arbitrary commands, or initiation of unauthorized network connections through the context of the user opening the spreadsheet. The affected systems are applications utilizing exceljs-hardened to generate CSV exports from untrusted or user-supplied data inputs.\nThe risk implications are severe for environments where generated CSV reports are consumed and reviewed locally by privileged users. Attackers require the capability to inject specific control characters into data fields that are subsequently processed by the export functionality. Mitigation requires upgrading to version 5.0.0 or later, where leading dangerous characters are properly neutralized during the serialization process.",
  "technicalDetails": "The vulnerability resides in the CSV serialization component of the exceljs-hardened library, specifically affecting versions prior to 5.0.0. The root cause is the failure to sanitize or neutralize leading special characters—specifically the equals sign (=), plus sign (+), minus sign (-), and at sign (@)—when writing cell values to CSV output streams.\nIn spreadsheet applications such as Microsoft Excel or LibreOffice Calc, cells beginning with these specific characters are interpreted not as literal string data, but as executable formulas or commands. When an external data source or authenticated user supplies malicious strings prefixed with these characters, exceljs-hardened writes them directly into the exported CSV file without escaping or quoting countermeasures.\nThe attack flow proceeds as follows: First, an attacker injects a payload containing a formula starting with one of the aforementioned dangerous characters into an application feature that ultimately gets exported via exceljs-hardened. Second, the application processes the request and generates a CSV file containing the unneutralized malicious payload. Third, a victim downloads and opens the resulting CSV file within a vulnerable spreadsheet application. Fourth, the spreadsheet application parses the leading character and executes the embedded formula automatically or upon user interaction, potentially triggering dynamic data exchange (DDE) execution, invoking external web resources for data exfiltration, or executing local system commands depending on the spreadsheet software configuration.\nNo specific authentication or privilege requirements are inherently imposed by the vulnerability itself, beyond the attacker's ability to supply input data that gets processed by the vulnerable export function. The network exposure is contingent on the application architecture handling the export generation and delivery. Post-exploitation impact encompasses compromise of the local client environment, unauthorized data access through HTTP requests generated by the formula, and potential lateral movement or persistent execution within the victim's local session."
}