Prototype Pollution in exceljs-hardened Library

CVE-2026-78207

What is CVE-2026-78207?

The exceljs-hardened library prior to version 5.0.0 is susceptible to a prototype pollution vulnerability. This flaw exists in the deepMerge helper function, which inadequately filters specific keys such as proto, constructor, or prototype when merging note objects. An attacker may exploit this by inserting malicious JSON containing a harmful proto property into cell notes. As a result, this can manipulate Object.prototype, leading to unintended modifications of all plain objects instantiated subsequently, thereby posing a significant security risk. Developers utilizing exceljs-hardened should promptly update to version 5.0.0 or later to mitigate this vulnerability.

References