https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-15T00:47:22.426144+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-128347 CVE-2026-128347 — ExcelJS through 4.4.0 Arbitrary File Read via WorkbookWriter addImage Filename 2026-11-15T00:47:22.427002+00:00

Affected: exceljs

ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows attackers to read local files by supplying crafted image filenames to addImage. Attackers can inject ../ path segments into user-controlled image paths, causing addMedia to embed any file readable by the Node.js process under xl/media in the generated workbook.