CVE-2026-128347

CVSS 8.7 (high) · published 2026-11-13

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.

Weakness: CWE-73

Source: NVD CVE-2026-128347

References

• https://github.com/exceljs/exceljs
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237
• https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29
• https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.