CVE-2026-78207 in exceljs-hardened
Summary
by MITRE • 08/24/2026
exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The security flaw identified in exceljs-hardened versions prior to 5.0.0 represents a critical prototype pollution vulnerability located within its deepMerge helper function. This utility is designed to recursively combine properties from source objects into target objects, a common pattern in JavaScript libraries for handling complex data structures such as spreadsheet cell notes. The core technical deficiency lies in the failure of this merging logic to validate or reject specific reserved property names during the recursive traversal process. Specifically, when processing input data that contains keys named _proto_, constructor, or prototype, the function proceeds to assign these values directly onto the target object without checking if they correspond to properties on Object.prototype rather than standard enumerable properties. This oversight allows an attacker who controls the input JSON payload to inject malicious entries into the global object prototype chain.
From a technical perspective, JavaScript objects inherit from Object.prototype by default unless explicitly created with null as their prototype using methods like Object.create(null). When a library merges data without sanitizing these reserved keys, it inadvertently sets properties on this shared prototype. For instance, if an attacker submits JSON containing {"_proto_": {"isAdmin": true}}, the deepMerge function will assign isAdmin to Object.prototype. Consequently, every plain object instantiated in the application after this merge operation will inherit the isAdmin property with a value of true. This behavior effectively bypasses any intended access control or logical checks that rely on the absence of such properties, as all subsequent objects appear to possess these attributes regardless of their actual configuration.
The operational impact of this vulnerability is severe and can lead to full application compromise depending on how the library is utilized within the broader system architecture. In web applications using exceljs-hardened for parsing user-uploaded Excel files or processing API data containing cell notes, an attacker could exploit this flaw to escalate privileges, bypass authentication mechanisms, or trigger denial of service conditions by polluting memory with excessive properties. If the application relies on checking for specific flags like isAdmin or isSuperUser to determine user roles, prototype pollution can trivially circumvent these checks. Furthermore, because Object.prototype is shared across all objects in the JavaScript execution context, a single successful exploit attempt affects the entire runtime environment of the Node.js process hosting the application, potentially impacting unrelated modules and services running within the same instance.
This vulnerability aligns with CWE-1321: Prototype Pollution via _proto_ property assignment, which categorizes flaws where an attacker can modify properties on Object.prototype through direct or indirect means. In terms of offensive security frameworks, this technique maps to ATT&CK Tactic TA0005 Defense Evasion and specifically the subtechnique for modifying object prototypes to bypass detection logic or access controls. The exploitation vector typically involves supplying crafted JSON data via file uploads or API endpoints that feed into the library's parsing routines, making it a remote code execution risk if combined with other vulnerabilities such as server-side request forgery or arbitrary command injection through prototype manipulation.
Mitigation strategies must focus on immediate version upgrades and defensive coding practices. The primary remediation is to upgrade exceljs-hardened to version 5.0.0 or later, where the deepMerge helper has been patched to explicitly check for and reject _proto_, constructor, and prototype keys before performing any assignment operations. For applications unable to update immediately due to dependency constraints, developers should implement a custom merge function that iterates through object keys and skips those matching reserved property names. Additionally, using Object.create(null) when creating new objects can prevent inheritance from the polluted prototype, although this requires significant refactoring of codebases relying on standard object behavior. Input validation at the entry point is also recommended to sanitize incoming JSON payloads before they reach any library functions that perform deep merging or recursive processing.