The flaw arises from the CSV export function in exceljs, which does not neutralize leading equals, plus, minus, or at signs in cell values. This omission allows an attacker to inject spreadsheet formulas that will be evaluated when a CSV file is opened in an application such as Microsoft Excel or LibreOffice Calc, potentially exfiltrating data or performing other malicious actions.

Versions of the exceljs library up to and including 4.4.0 are impacted. Applications that depend on these releases and use the CSV export feature are therefore vulnerable, regardless of the underlying operating system.

The vulnerability carries a CVSS score of 8.4, indicating high severity. EPSS data is not available, but the lack of a KEV listing does not reduce its risk. Attackers who can influence cell content prior to CSV export—through web forms, API requests, or code modifications—can trigger the exploitation. Execution occurs when the victim opens the resulting CSV file in a spreadsheet application, making user interaction a local factor. Thus, the risk depends on data control, user behavior, and potential automation of CSV opening.