exceljs through 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

Versions of the exceljs library up to and including 4.4.0 are impacted. Applications that depend on these releases and use the CSV export feature are therefore vulnerable, regardless of the underlying operating system.

The vulnerability carries a CVSS score of 8.4, indicating high severity. The EPSS score is less than 1%, indicating a very low exploitation probability; however, the lack of a KEV listing does not reduce its risk. Attackers who can influence cell content prior to CSV export—through web forms, API requests, or code modifications—can trigger the exploitation. Execution occurs when the victim opens the resulting CSV file in a spreadsheet application, making user interaction a local factor. Thus, the risk depends on data control, user behavior, and potential automation of CSV opening.