CVE-2026-78208

If you're using exceljs-hardened, be aware that CVE-2026-78208 is a path traversal vulnerability in Workbook.addImage() that allows arbitrary file read. This matters specifically because you chose this library precisely to avoid vulnerabilities like this—which means you're in the population least likely to add your own input validation around this function. The vulnerability is a deliberate exfiltration vector. Embedding malicious content inside a generated .xlsx file bypasses the suspicion that typically guards file downloads. An attacker who compromises your application or entices a user to process a crafted workbook can exfiltrate sensitive files without triggering conventional download safeguards. The deeper problem is that 'hardened' forks create a false security contract. The hardening effort was a snapshot—it addressed known vulnerabilities at a point in time, but new functions added afterward (like addImage()) received different scrutiny. The fork's maintainers weren't building a comprehensive security product; they were patching documented CVEs. But the label 'hardened' convinced developers to stop auditing that code path themselves. That's the trap: the act of choosing security-focused software reduced the defensive coding behavior that would have caught this. What you should do: treat exceljs-hardened as having patched specific historical vulnerabilities, not as comprehensively secure. Add your own path validation before calling addImage(). Assume any function you didn't see explicitly hardened in the changelog carries normal risk. The most dangerous fork is the one that makes you stop looking—and that's exactly what the 'hardened' label does.

Reviewed through automated stages and approved by a human before publication.