CVE-2026-128348 | ExcelJS up to 4.4.0 Totals Row Formula Getter lib/doc/table.js injection

November 13, 2026 Yanac

A vulnerability described as critical has been identified in ExcelJS up to 4.4.0. Affected by this vulnerability is an unknown functionality of the file lib/doc/table.js of the component Totals Row Formula Getter. Executing a manipulation can lead to injection.

This vulnerability appears as CVE-2026-128348. The attack may be performed from remote. There is no available exploit.VulDB Recent EntriesRead More