{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/exceljs-hardened/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.4,"id":"CVE-2026-78207"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["exceljs-hardened","exceljs-hardened (\u003c 5.0.0)"],"_cs_severities":["high"],"_cs_tags":["path-traversal","vulnerability","npm","information-disclosure"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe exceljs-hardened library, a hardened fork of the popular exceljs Node.js package, contains a critical prototype pollution vulnerability (CVE-2026-78207) in its \u003ccode\u003edeepMerge\u003c/code\u003e helper function. The vulnerability exists because the function fails to sanitize or reject sensitive keys such as \u003ccode\u003e__proto__\u003c/code\u003e, \u003ccode\u003econstructor\u003c/code\u003e, or \u003ccode\u003eprototype\u003c/code\u003e during the merging of JSON objects representing Excel cell notes. An attacker capable of influencing the input parsed by the library can leverage this flaw to pollute the global \u003ccode\u003eObject.prototype\u003c/code\u003e. Once the prototype is polluted, the attacker can modify the behavior of all plain objects within the JavaScript application's process. This can lead to various outcomes depending on the application logic, including remote code execution (RCE) if the application relies on polluted properties for security-sensitive checks, or service disruption. The issue impacts all versions prior to 5.0.0.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe application parses untrusted user-supplied JSON data intended for Excel file generation or processing.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious JSON payload containing a \u003ccode\u003e__proto__\u003c/code\u003e property with arbitrary nested attributes.\u003c/li\u003e\n\u003cli\u003eThe malicious payload is passed to the \u003ccode\u003eexceljs-hardened\u003c/code\u003e library for processing as a cell note object.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003edeepMerge\u003c/code\u003e helper function is invoked to merge the object properties.\u003c/li\u003e\n\u003cli\u003eThe function fails to identify or block the \u003ccode\u003e__proto__\u003c/code\u003e key during the recursive merge process.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eObject.prototype\u003c/code\u003e is modified with the malicious property defined by the attacker.\u003c/li\u003e\n\u003cli\u003eThe application subsequently performs operations on other objects that inherit from the modified prototype.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves code execution or logic bypass by influencing the application's processing of these polluted objects.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-78207 allows an attacker to manipulate the execution environment of a Node.js application. While the direct impact is prototype pollution, this vulnerability serves as a primitive for more severe attacks, such as cross-site scripting (XSS), bypass of security controls, or remote code execution, depending on how the application handles object properties. Any Node.js-based web service that utilizes \u003ccode\u003eexceljs-hardened\u003c/code\u003e to process user-provided spreadsheet files is at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u003ccode\u003eexceljs-hardened\u003c/code\u003e dependency to version 5.0.0 or later immediately to include the required sanitization patches for the \u003ccode\u003edeepMerge\u003c/code\u003e helper.\u003c/li\u003e\n\u003cli\u003eAudit application code for usage of \u003ccode\u003eexceljs-hardened\u003c/code\u003e to confirm exposure and ensure that user-supplied input is validated before being passed to library functions.\u003c/li\u003e\n\u003cli\u003eImplement Input Validation and Sanitization for all JSON objects processed by the library.\u003c/li\u003e\n\u003cli\u003eRestrict the ability of untrusted users to upload or modify spreadsheet content processed by the application.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-24T01:41:01Z","date_published":"2026-08-24T01:40:00Z","id":"https://feed.craftedsignal.io/briefs/2026-08-exceljs-prototype-pollution/","summary":"The exceljs-hardened library before version 5.0.0 is vulnerable to prototype pollution, allowing unauthenticated remote attackers to inject malicious properties into Object.prototype via crafted cell note data.","title":"Prototype Pollution Vulnerability in exceljs-hardened","url":"https://feed.craftedsignal.io/briefs/2026-08-exceljs-prototype-pollution/"}],"language":"en","title":"CraftedSignal Threat Feed - Exceljs-Hardened","version":"https://jsonfeed.org/version/1.1"}