P4Verified

CVE-2026-78208: exceljs 0 through 4.4.0

CVE-2026-78208. CVSS 3.1 base score 7.5 (HIGH, Vendor/CNA). EPSS 0.00508 (percentile 0.4178), scored 13-Oct-2026.

Affected technology

exceljs · 0 through 4.4.0
exceljs

Description’s affected range: through 4.4.0

Component: Not specified by the source
Function: that

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook. Vendor/CNA’s CVSS 4.0 assessment (base score 8.7/10) rates confidentiality impact as high; integrity and availability impact as none.

Published 14-Oct-2026 15:58 UTC

CWE: CWE-73
CCR priority: 30.1 /100 (P4)
CVSS 3.1: 7.5 /10 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · Vendor/CNA
EPSS: 0.00508 · percentile 0.4178 · 2026-10-13
KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-14 15:56:36.793806+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-78208.html