A critical (CVSS 9.4) prototype pollution flaw in the exceljs deepMerge helper lets attacker-controlled cell notes modify Object.prototype across the entire process.
What Is It
CVE-2026-78207 is a prototype pollution vulnerability (CWE-1321) in the deepMerge helper used when merging note objects. The helper fails to reject __proto__, constructor, or prototype keys. An attacker who can supply parsed JSON containing a malicious __proto__ property, assigned to a cell note, can modify Object.prototype, affecting every plain object created in the process thereafter.
The flaw was reported by VulnCheck and traced to the merge logic in lib/utils/under-dash.js in exceljs v4.4.0.
Why It Matters
The CVSS 3.1 base score is 9.4 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L. That combination, network attack vector, low complexity, no privileges, and no user interaction, means an attacker needs only the ability to get a crafted spreadsheet or JSON note through the parsing path. Impact is High for both confidentiality and integrity, with Low availability impact. The CVSS 4.0 score assigned by the same source is 9.3 (CRITICAL).
Because prototype pollution corrupts Object.prototype process-wide, downstream code that never touches spreadsheet data can inherit attacker-controlled properties, making blast radius hard to bound.
What's Vulnerable
- Package:
exceljs(npm),pkg:npm/exceljs - Affected versions: all versions up to and including 4.4.0 (semver; default status for other versions is unaffected)
- Hardened fork:
exceljs-hardenedbefore 5.0.0
No CPE entries are listed in the NVD record.
Patch Status
The NVD record lists no CISA KEV entry for this CVE, so there is no confirmed active exploitation and no federally mandated remediation deadline at this time. The advisory indicates the issue is resolved in exceljs-hardened 5.0.0 and later; users on exceljs 4.4.0 or earlier should consult the GHSA and VulnCheck advisories below for upgrade guidance. NVD status is currently "Received" (published 2026-08-23), meaning the record has not yet completed analysis.