Prototype Pollution in exceljs-hardened via Malicious Cell Notes

Executive Summary

CVE-2026-78207 is a prototype pollution vulnerability in exceljs-hardened versions before 5.0.0. The deepMerge helper function fails to reject dangerous keys like __proto__, constructor, or prototype when merging note objects. Attackers can inject malicious JSON with a crafted __proto__ property into cell notes, modifying Object.prototype and affecting all plain objects created afterward.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect applications using exceljs versions up to 4.4.0 for improper handling of cell notes with JSON objects. Check if deepMerge functions process keys like __proto__, constructor, or prototype without validation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized data modification, confidentiality breaches, and system compromise. It may affect authorization decisions in unrelated endpoints by altering object properties globally. Attackers could execute arbitrary code or manipulate application behavior due to the prototype pollution.

Useful 0 Not Useful 0

Compliance Impact

This prototype pollution vulnerability could lead to unauthorized data modification, confidentiality breaches, and system compromise by allowing attackers to modify Object.prototype. This may impact compliance with GDPR (data protection) and HIPAA (health data privacy) by enabling unauthorized access or alteration of sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to exceljs-hardened version 5.0.0 or later. If using the original exceljs, avoid assigning unvalidated JSON to cell.note properties. Implement input validation to filter dangerous keys like __proto__ before object merging.

Useful 0 Not Useful 0