CVE-2026-128337 | ExcelJS up to 4.4.0 mergeConditionalFormattings prototype pollution

November 13, 2026 Yanac

A vulnerability was found in ExcelJS up to 4.4.0. It has been rated as critical. The affected element is the function mergeConditionalFormattings. The manipulation leads to improperly controlled modification of object prototype attributes.

This vulnerability is listed as CVE-2026-128337. The attack may be initiated remotely. There is no available exploit.VulDB Recent EntriesRead More