Vulnerability details
CVE-2026-78207
exceljs exceljs
exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization
CVSS 4.0
9.3Critical
Official description
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
| 9.4Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| exceljs | exceljs | v ≤ 4.4.0 | CVEProject cvelistV5 (CNA) |
References and advisories
4- https://github.com/exceljs/exceljs product
- https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qwr4-7h29-chpf third-party-advisoryvendor-advisory
- https://github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/under-dash.js#L155-L181 technical-description
- https://www.vulncheck.com/advisories/exceljs-through-prototype-pollution-via-deepmerge-reached-from-note-serialization third-party-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-24
- Last updated
- 2026-11-08
- State
- Published
- Assigner (CNA)
- VulnCheck
Exploit prediction (EPSS)
0.6%
Probability of exploitation in 30 days
49%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')