CVE-2026-78207 Overview
CVE-2026-78207 is a prototype pollution vulnerability in exceljs-hardened versions before 5.0.0. The flaw resides in the deepMerge helper, which fails to reject __proto__, constructor, and prototype keys when merging note objects. Attackers can supply parsed JSON with a malicious __proto__ property assigned to cell notes, modifying Object.prototype and affecting every plain object created in the process. The weakness is classified as [CWE-1321] (Improperly Controlled Modification of Object Prototype Attributes). Because the library is reachable through note serialization, exploitation requires no authentication and can be triggered remotely by supplying crafted spreadsheet data.
Critical Impact
Remote attackers can pollute Object.prototype across the Node.js runtime, enabling privilege escalation, authentication bypass, or arbitrary code execution paths depending on downstream consumers.
Affected Products
- exceljs-hardened npm package, all versions prior to 5.0.0
- Node.js applications importing exceljs-hardened for spreadsheet parsing
- Downstream libraries that pass untrusted JSON to note serialization routines
Discovery Timeline
- 2026-08-24 - CVE-2026-78207 published to NVD
- 2026-08-24 - Last updated in NVD database
Technical Details for CVE-2026-78207
Vulnerability Analysis
The exceljs-hardened package provides a hardened fork of ExcelJS for reading and writing spreadsheet files in Node.js. Its deepMerge utility recursively copies properties from a source object into a target object. When the helper encounters keys such as __proto__, constructor, or prototype, it copies them without validation. Assigning to these keys does not create own properties on the note object; instead, it mutates Object.prototype itself. Every plain object created afterward inherits the injected properties. Attackers reach the vulnerable code path through cell note serialization, where user-controlled JSON is merged into an internal note representation.
Root Cause
The root cause is the absence of a key allowlist or blocklist in deepMerge. The function iterates source properties using standard enumeration and assigns each into the target without checking whether the key refers to a prototype accessor. This pattern is a canonical [CWE-1321] weakness. See the ExcelJS Utility Function Code for the equivalent upstream logic.
Attack Vector
An unauthenticated remote attacker submits a spreadsheet or JSON payload containing a cell note whose value has a __proto__ property. When the application parses and processes the workbook, deepMerge walks into the note object and assigns the attacker-controlled properties onto Object.prototype. Subsequent code that reads properties from freshly created plain objects returns polluted values, which can subvert authorization checks, template rendering, or command construction depending on the host application.
Refer to the GitHub Security Advisory GHSA-qwr4-7h29-chpf and the VulnCheck Advisory on ExcelJS for additional exploitation context.
Detection Methods for CVE-2026-78207
Indicators of Compromise
- Spreadsheet or JSON inputs containing note objects with __proto__, constructor, or prototype keys.
- Unexpected properties appearing on plain objects at runtime, especially values that were never assigned by application code.
- Node.js processes loading exceljs-hardened at versions below 5.0.0 reported by software composition analysis.
Detection Strategies
- Inventory dependencies with npm ls exceljs-hardened and flag any version prior to 5.0.0.
- Add runtime assertions or use Object.freeze(Object.prototype) in test environments to surface pollution attempts during CI.
- Inspect ingestion logs for cell notes whose JSON representation contains reserved prototype key names.
Monitoring Recommendations
- Alert on spreadsheet uploads whose parsed payload includes __proto__, constructor.prototype, or nested prototype keys.
- Monitor Node.js application logs for anomalous exceptions or type coercion errors after workbook processing.
- Track outbound requests and child process launches immediately following spreadsheet ingestion for signs of downstream exploitation.
How to Mitigate CVE-2026-78207
Immediate Actions Required
- Upgrade exceljs-hardened to version 5.0.0 or later across all Node.js services.
- Audit any wrapper code that forwards user-supplied JSON into workbook note fields.
- Restrict spreadsheet uploads to authenticated users where feasible until patches are deployed.
Patch Information
The maintainer released exceljs-hardened 5.0.0, which rejects __proto__, constructor, and prototype keys inside deepMerge. Details are documented in GitHub Security Advisory GHSA-qwr4-7h29-chpf. Rebuild and redeploy dependent applications after updating the lockfile.
Workarounds
- Call Object.freeze(Object.prototype) at application startup to block prototype mutation.
- Wrap deepMerge callers with a sanitizer that strips __proto__, constructor, and prototype keys before merging.
- Validate spreadsheet inputs with a schema that rejects reserved property names in note fields.
# Configuration example
npm install exceljs-hardened@^5.0.0
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
