CVE-2026-78207
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
The exceljs library through version 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.
Risk Assessment
Prototype pollution can lead to unauthorized access, privilege escalation, or code execution in applications using exceljs. This may compromise data integrity and overall system security.
Recommendation
Update the exceljs library to the latest version that includes a fix. If not available, avoid processing untrusted input with cell notes or manually filter dangerous keys.
Other vulnerabilities in exceljs
See all- CVE-2026-78209High
The exceljs library through version 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.
- CVE-2026-78208High
The exceljs library through version 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.
- CVE-2026-78206High
The exceljs library through version 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.
Original NVD description (English source)
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS