CVE-2026-128337

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-128337
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128337.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-128337
Aliases
  • GHSA-86ch-m4gp-r5xf
Published
2026-11-13T09:33:37Z
Modified
2026-11-14T02:47:33Z
Severity
  • 8.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
ExcelJS through 4.4.0 Prototype Pollution via x14 Conditional Formatting Rule ID
Details

ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers to modify Object.prototype by supplying an x14:cfRule id of proto. Attackers can craft an xlsx file that, when loaded with xlsx.load(), sets properties such as type, direction, border and cfvo on every object in the process until it restarts.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/128xxx/CVE-2026-128337.json"
}
References

Affected packages

Git / github.com/exceljs/exceljs

Affected ranges

Type
GIT
Repo
https://github.com/exceljs/exceljs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last Affected
ac96f9a61e9799c7776bd940f05c4a51d7200209
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "last_affected": "4.4.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        }
    ]
}

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.4
0.0.5
0.0.6
0.0.7
0.0.8
0.0.9
0.1.0
0.1.1
0.1.10
0.1.11
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1
0.2.10
0.2.11
0.2.12
0.2.15
0.2.16
0.2.17
0.2.18
0.2.19
0.2.2
0.2.20
0.2.21
0.2.22
0.2.23
0.2.24
0.2.26
0.2.27
0.2.28
0.2.29
0.2.3
0.2.30
0.2.31
0.2.33
0.2.34
0.2.35
0.2.36
0.2.8
v0.*
v0.0.1
v0.0.2
v0.0.3
v0.0.4
v0.0.5
v0.0.6
v0.0.7
v0.0.8
v0.0.9
v0.1.0
v0.1.1
v0.1.10
v0.1.11
v0.1.2
v0.1.3
v0.1.4
v0.1.5
v0.1.6
v0.1.7
v0.1.8
v0.1.9
v0.2.0
v0.2.1
v0.2.10
v0.2.11
v0.2.12
v0.2.15
v0.2.16
v0.2.17
v0.2.18
v0.2.19
v0.2.2
v0.2.20
v0.2.21
v0.2.22
v0.2.23
v0.2.24
v0.2.26
v0.2.27
v0.2.28
v0.2.29
v0.2.3
v0.2.30
v0.2.31
v0.2.33
v0.2.34
v0.2.35
v0.2.36
v0.2.8
v0.4.10
v0.4.11
v0.4.12
v0.4.13
v0.4.14
v0.4.9
v0.5.0
v0.5.1
v0.6.0
v0.6.2
v0.7.0
v0.7.1
v0.8.0
v0.8.1
v0.8.2
v0.8.3
v0.8.4
v0.8.5
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.1
v1.0.2
v1.1.0
v1.1.1
v1.1.2
v1.1.3
v1.10.0
v1.11.0
v1.12.0
v1.12.1
v1.12.2
v1.13.0
v1.14.0
v1.15.0
v1.2.0
v1.2.1
v1.3.0
v1.4.0
v1.4.1
v1.4.10
v1.4.11
v1.4.12
v1.4.13
v1.4.2
v1.4.3
v1.4.4
v1.4.5
v1.4.6
v1.4.7
v1.4.8
v1.4.9
v1.5.0
v1.5.1
v1.6.0
v1.6.1
v1.6.2
v1.6.3
v1.7.0
v1.8.0
v1.9.0
v1.9.1
v2.*
v2.0.0
v2.0.1
v3.*
v3.0.0
v3.1.0
v3.10.0
v3.2.0
v3.3.0
v3.3.1
v3.4.0
v3.5.0
v3.7.0
v3.8.0
v3.8.1
v3.8.2
v3.9.0
v4.*
v4.0.0
v4.0.1
v4.1.0
v4.1.1
v4.2.0
v4.2.1
v4.3.0
v4.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-128337.json"