CVE-2026-78207

Name of the Vulnerable Software and Affected Versions exceljs-hardened versions prior to 5.0.0

Description An issue exists in the deepMerge helper that fails to reject proto, constructor, or prototype keys when merging note objects. This allows attackers to assign parsed JSON containing a malicious proto property to cell notes, which modifies Object.prototype and affects all plain objects created within the process. This is known as prototype pollution, a condition where an attacker can manipulate the base prototype of an object to inject properties into all objects of that type.

Recommendations Update to version 5.0.0 or later.