exceljs-hardened versions before 5.0.0 fail to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
This vulnerability represents a classic formula injection attack where the exceljs-hardened library fails to sanitize cell values before CSV export. When attackers control spreadsheet cell content, they can prepend special characters (=, +, -, @) that transform innocent data into executable formulas. Upon opening the CSV in applications like Excel or Google Sheets, these formulas execute automatically, potentially allowing data exfiltration, remote code execution, or lateral movement. Any organization using exceljs-hardened versions before 5.0.0 to export user-influenced data faces significant risk, particularly SaaS platforms, reporting tools, and financial applications that generate downloadable reports.
Casky's Claude-powered analysis detects this vulnerability pattern through T1059.003 (Command and Scripting Interpreter: Windows Command Shell) reconnaissance by identifying formula injection signatures in exported CSV outputs. Practitioners querying Casky would receive findings flagging suspicious cell value transformations—specifically patterns where untrusted input is written directly to CSV without neutralization of leading formula-triggering characters. The extended reasoning capability allows Claude to correlate the library version, data flow paths, and export functionality to surface the attack chain: user input → database storage → CSV generation → formula execution. Security teams would see actionable alerts recommending immediate patching to version 5.0.0+ and implementation of input validation layers that strip or escape formula-triggering characters before any export operation.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-78209. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation