CyberRota Analysis
AI-GeneratedVersions of exceljs-hardened prior to 5.0.0 are vulnerable to formula injection in CSV outputs, allowing attackers to manipulate exported cell values with leading characters such as equals, plus, minus, or at signs. This vulnerability can lead to the execution of arbitrary formulas when the CSV file is opened, posing a risk of data exfiltration and other malicious activities. Organizations using this library should prioritize patching to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.