The vulnerability arises from the Workbook.addImage() function in exceljs, which does not validate the filename supplied by the caller. This allows an attacker to supply a crafted path such as "../../../../etc/passwd" and cause the library to read and embed the contents of that file into the generated workbook. The flaw is categorized as CWE-73 and results in local file read and potential information disclosure. An attacker who can supply the filename can read any file that the Node.js process has permission to access, potentially leaking sensitive configuration, credentials, or other confidential data.

The affected product is exceljs and the hardened variant of exceljs prior to version 5.0.0. The vulnerability is present in releases up through version 4.4.0. Any project that imports or uses the exceljs library, directly or via a hardened wrapper, before upgrading to 5.0.0 or later, could be affected.

The CVSS score of 8.7 marks this as a high‑severity flaw. Although an EPSS score is not provided, the absence of a known public exploit does not mitigate the risk; the flaw can be leveraged if an attacker can control the filename argument passed to addImage. This typically requires that the attacker has some influence over the input processed by the Node.js application or that the application itself is compromised. The Node.js process must have read access to the target file, which is usually the case for many deployments. Because the flaw can read arbitrary files, the impact on confidentiality can be significant, and the lack of a KEV listing does not mean it is safe. The safest assumption is that the vulnerability poses a high likelihood of exploitation in environments where attacker-controlled input can reach the addImage call.