Description

exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-24T01:16:58.137Z",
  "pubdate": "2026-08-24T01:16:58.137Z",
  "executiveSummary": "A prototype pollution vulnerability exists in exceljs-hardened before version 5.0.0, specifically within the deepMerge helper function. The vulnerability arises from an inadequate validation mechanism that fails to reject forbidden keys such as __proto__, constructor, or prototype during the merging of note objects. This flaw allows malicious threat actors to supply crafted parsed JSON data containing malicious __proto__ properties assigned to cell notes.\nSuccessful exploitation of this vulnerability results in the modification of the global Object.prototype. Consequently, this pollution impacts all plain JavaScript objects created throughout the execution lifecycle of the affected process. The risk implications include potential application instability, logic bypasses, denial of service, or remote code execution depending on how subsequent objects consume the polluted prototype properties.\nThe attack capability requires the ability to inject or manipulate parsed JSON data processed by the vulnerable exceljs-hardened package. No specific authentication or privilege requirements are inherently defined by the vulnerability itself, but exploitability depends on the application's exposure to untrusted input sources when handling cell notes.",
  "technicalDetails": "The root cause of the vulnerability resides in the deepMerge helper function implemented within the exceljs-hardened library prior to version 5.0.0. When performing recursive object merging operations for cell note objects, the implementation fails to implement strict input sanitization or key blacklisting checks. Specifically, it permits keys such as __proto__, constructor, and prototype to pass through the merge logic without validation.\nThe vulnerable component is the deepMerge utility function responsible for traversing and combining nested object structures. The affected versions comprise all iterations of exceljs-hardened prior to 5.0.0.\nThe exploitation method begins when an attacker supplies malicious input via parsed JSON containing specially crafted properties targeting JavaScript prototype chains, specifically __proto__. Because the deepMerge helper processes these objects without filtering out reserved JavaScript identifiers, the assignment targets the internal prototype of the base Object rather than a standard instance property.\nThe step-by-step attack flow proceeds as follows: First, an attacker crafts a malicious JSON payload incorporating a __proto__ property mapped to arbitrary properties or functions. Second, the application passes this untrusted JSON data into the ExcelJS workflow involving cell notes. Third, the deepMerge helper function processes the note object, recursively assigning the attacker-controlled properties. Fourth, instead of modifying the target object instance, the execution context traverses up the reference chain and writes the properties directly into Object.prototype.\nFollowing successful prototype pollution, the post-exploitation impact affects every plain JavaScript object instantiated within the Node.js runtime environment. The malicious properties injected via the cell note are now universally inherited across the application space. This can lead to unexpected type conversions, property injection vulnerabilities in downstream libraries, security control bypasses, or application crashes resulting in a denial of service.\nNetwork exposure and execution vectors depend entirely on how the host application integrates exceljs-hardened to ingest external files or user-supplied JSON payloads. If the application exposes endpoints that process untrusted spreadsheets or JSON structures containing cell notes without prior validation, remote exploitation is feasible."
}