Prototype Pollution Vulnerability in exceljs-hardened

The exceljs-hardened library, a hardened fork of the popular exceljs Node.js package, contains a critical prototype pollution vulnerability (CVE-2026-78207) in its deepMerge helper function. The vulnerability exists because the function fails to sanitize or reject sensitive keys such as __proto__, constructor, or prototype during the merging of JSON objects representing Excel cell notes. An attacker capable of influencing the input parsed by the library can leverage this flaw to pollute the global Object.prototype. Once the prototype is polluted, the attacker can modify the behavior of all plain objects within the JavaScript application's process. This can lead to various outcomes depending on the application logic, including remote code execution (RCE) if the application relies on polluted properties for security-sensitive checks, or service disruption. The issue impacts all versions prior to 5.0.0.

Attack Chain

1. The application parses untrusted user-supplied JSON data intended for Excel file generation or processing.
2. The attacker crafts a malicious JSON payload containing a __proto__ property with arbitrary nested attributes.
3. The malicious payload is passed to the exceljs-hardened library for processing as a cell note object.
4. The deepMerge helper function is invoked to merge the object properties.
5. The function fails to identify or block the __proto__ key during the recursive merge process.
6. The Object.prototype is modified with the malicious property defined by the attacker.
7. The application subsequently performs operations on other objects that inherit from the modified prototype.
8. The attacker achieves code execution or logic bypass by influencing the application's processing of these polluted objects.

Impact

Successful exploitation of CVE-2026-78207 allows an attacker to manipulate the execution environment of a Node.js application. While the direct impact is prototype pollution, this vulnerability serves as a primitive for more severe attacks, such as cross-site scripting (XSS), bypass of security controls, or remote code execution, depending on how the application handles object properties. Any Node.js-based web service that utilizes exceljs-hardened to process user-provided spreadsheet files is at risk.

Recommendation

• Update the exceljs-hardened dependency to version 5.0.0 or later immediately to include the required sanitization patches for the deepMerge helper.
• Audit application code for usage of exceljs-hardened to confirm exposure and ensure that user-supplied input is validated before being passed to library functions.
• Implement Input Validation and Sanitization for all JSON objects processed by the library.
• Restrict the ability of untrusted users to upload or modify spreadsheet content processed by the application.