CVE-2026-78207: exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious proto property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
exceljsto a version that resolves this vulnerability.Fixed in 4.4.0 - Upgrade
Upgrade
exceljs-hardenedto a version that resolves this vulnerability.Fixed in 5.0.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using exceljs-hardened versions before 5.0.0 are affected if untrusted parsed JSON can be assigned to cell notes and then processed through note serialization.
What does an attacker need to exploit this issue?
An attacker needs a way to supply or influence parsed JSON assigned to cell notes. The malicious object must include a __proto__, constructor, or prototype key that reaches the deepMerge helper.
What is the impact once exploitation succeeds?
The vulnerable merge can modify Object.prototype, affecting all plain objects subsequently created in the process. The reported impact includes high confidentiality and integrity impact and low availability impact.
What should teams do if they cannot immediately upgrade?
Do not assign untrusted parsed JSON directly to cell notes. Validate or recursively sanitize note objects to reject __proto__, constructor, and prototype keys before they reach note serialization.