CVE-2026-128347

Description

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.

References

• https://github.com/exceljs/exceljs
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L124-L130
• https://github.com/exceljs/exceljs/blob/v4.4.0/lib/stream/xlsx/workbook-writer.js#L230-L237
• https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-f9m8-8qmf-qq29
• https://www.vulncheck.com/advisories/exceljs-through-4.4.0-arbitrary-file-read-via-workbookwriter-addimage-filename