CVE-2026-128336 | ExcelJS up to 4.4.0 xl/workbook.xml workbook.xlsx.load prototype pollution

November 13, 2026 Yanac

A vulnerability was found in ExcelJS up to 4.4.0 and classified as critical. This vulnerability affects the function workbook.xlsx.load of the file xl/workbook.xml. Such manipulation leads to improperly controlled modification of object prototype attributes.

This vulnerability is referenced as CVE-2026-128336. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More