high severity · published 2026-11-13
Attackers can inject dot-dot path segments into a user-controlled image filename passed to addImage, so the streaming WorkbookWriter embeds any file readable by the Node.js process into the workbook under xl/media. Whoever obtains the generated workbook can read those local files.
CVE: CVE-2026-128347
Source: NVD
FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 2795 and your operating system.