Skip to main content
cve.nowby Sazabi
← npm
npmPackage

exceljs

5 known vulnerabilities (1 critical, 3 high), with the versions each affects and the releases that fix them.

Latest release
4.4.0 (Oct 19, 2023): affected by 4 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
5 · 1 critical, 3 high
Weekly downloads
26.2M
Dependents
5,009
Releases
166 since 0.0.1 (Dec 9, 2014)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

    Affected: through 4.4.0.

    No fix released. The latest release, 4.4.0, is still affected.

    99.8% of exceljs downloads last week were affected versions (28.2M).

  • exceljs through 4.4.0 Path Traversal via Unvalidated addImage filename

    Affected: through 4.4.0.

    No fix released. The latest release, 4.4.0, is still affected.

    99.8% of exceljs downloads last week were affected versions (28.2M).

  • CVE-2026-78207Critical 9.3

    exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization

    Affected: through 4.4.0.

    No fix released. The latest release, 4.4.0, is still affected.

    99.8% of exceljs downloads last week were affected versions (28.2M).

  • exceljs through 4.4.0 Uncontrolled Resource Consumption via Unbounded xlsx Decompression

    Affected: through 4.4.0.

    No fix released. The latest release, 4.4.0, is still affected.

    99.8% of exceljs downloads last week were affected versions (28.2M).

  • An unescaped payload in exceljs <v1.6 allows a possible XSS via cell value when worksheet is displayed in browser.

    Affected: fixed in 1.6.0.

    Fixed in 1.6.0 (released Aug 2, 2018, 35 days before disclosure).

    The latest release, 4.4.0, is not affected.

    <0.1% of exceljs downloads last week were affected versions (8.5K).