The vulnerability originates from the Workbook.addImage() function in exceljs, which fails to validate the file path supplied by the caller. By providing arbitrary file paths, an attacker can cause the library to read any file the Node.js process can access and embed its contents into the generated workbook. This flaw, categorized as CWE-73, allows local file read and potential information disclosure, as sensitive files such as configuration or credential files could be exposed when the workbook is served or opened.

The affected product is exceljs and the hardened variant of exceljs prior to version 5.0.0. The vulnerability is present in releases up through version 4.4.0. Any project that imports or uses the exceljs library, directly or via a hardened wrapper, before upgrading to 5.0.0 or later, could be affected.

The CVSS score of 8.7 marks this as a high‑severity flaw. Although the EPSS score is low (<1%), the high CVSS score indicates potential for significant impact if the flaw is exploited. This typically requires that the attacker has some influence over the input processed by the Node.js application or that the application itself is compromised. The Node.js process must have read access to the target file, which is usually the case for many deployments. Because the flaw can read arbitrary files, the impact on confidentiality can be significant, and the lack of a KEV listing does not mean it is safe. Given the low EPSS, exploitation is likely to be rare, though the flaw could still be leveraged if attacker‑controlled input can reach the addImage call.