CVE-2026-78209 is a CSV formula injection vulnerability in exceljs-hardened versions prior to 5.0.0. The library, which explicitly markets itself as a security-hardened fork of exceljs, fails to escape the four characters that trigger formula evaluation when CSV files are opened in Excel: equals (=), plus (+), minus (-), and at (@). An attacker who controls data written to any exported cell can prepend one of these characters to inject arbitrary formulas into the resulting CSV file.
When opened in Excel, these formulas execute in the context of the user's workstation—potentially exfiltrating data via DDE, launching external programs, or performing calculations that expose sensitive information. The attack requires no macros and bypasses many traditional file-based security controls because CSV files are treated as inert plaintext. The severity is amplified by the library's branding: downstream systems likely disabled their own output encoding precisely because they trusted a library marketed as hardened. If you adopted exceljs-hardened and disabled CSV sanitization elsewhere in your pipeline, you must re-enable it and verify the library's 5.0.0 patch handles your specific data patterns correctly—particularly if legitimate cell values legitimately begin with these characters.
Verify your deployed version immediately. The fix involves prefixing any cell value beginning with =, +, -, or @ with a single quote (') to force Excel to treat it as text. This is not a complex vulnerability technically—it was a visibility failure. The library's threat model appears to have focused on malicious file parsing (the input direction) while treating CSV export as a benign transformation. This is a common blind spot in security tooling: hardening gets associated with 'don't let bad files in' while 'don't produce bad files out' is assumed to be someone else's responsibility.
For defenders: audit your data flow to determine whether untrusted input reaches any CSV export path, regardless of which library you use. The 'hardened' label created an expectation of comprehensive security coverage that didn't exist—this is a reminder that security-labeled dependencies can absorb the defensive layering that would otherwise occur downstream.