exceljs-hardened Prototype Pollution via deepMerge (CVE-2026-78207)

Technical Analysis

The vulnerability resides in the deepMerge helper function used to process Excel cell notes, which recursively merges attacker-controlled JSON without filtering __proto__, constructor, or prototype keys, allowing global pollution of Object.prototype for all plain objects in the Node.js process. This class of vulnerability commonly escalates to RCE when polluted properties are later consumed by unsafe deserialization, templating engines, or child_process invocations, and can also enable authentication bypass or privilege escalation if security-relevant object properties are overwritten. Exploitation requires an attacker to supply a crafted .xlsx file or JSON payload processed by an application using the vulnerable library, making it a plausible attack vector in document ingestion pipelines, automated reporting tools, and file-upload services. Given the CVSS score of 9.4, the flaw is remotely exploitable with low complexity and can result in significant confidentiality, integrity, and availability impact. AI agent systems and RAG pipelines that ingest and parse untrusted spreadsheet files (e.g., for document analysis, data extraction, or tool-based file processing) using exceljs-hardened are directly exposed, as prototype pollution could corrupt shared object state across agent tool calls, leak API keys/credentials held in polluted objects, or enable downstream code execution within the agent's execution environment.

Affected Systems

Node.js applications using exceljs-hardened npm package versions prior to 5.0.0; specifically any service parsing .xlsx files or cell note JSON structures, including document processing microservices, automated reporting systems, file upload handlers, and AI agent/RAG tool integrations that ingest spreadsheet data.

Indicators of Compromise

• Package: exceljs-hardened (npm) versions < 5.0.0
• Malicious payload pattern: JSON objects containing "__proto__", "constructor", or "prototype" keys embedded in cell note structures
• Suspicious .xlsx files with anomalous note/comment XML containing nested __proto__ references

Remediation Steps

1. 1

   Upgrade exceljs-hardened

   Update to exceljs-hardened version 5.0.0 or later, which includes key filtering in the deepMerge helper to reject __proto__, constructor, and prototype keys.

2. 2

   Input validation and sanitization

   Implement strict schema validation on parsed spreadsheet/note data before merging, explicitly denylisting dangerous prototype keys at the application layer as defense-in-depth.

3. 3

   Use Object.create(null) or Maps

   Where feasible, refactor internal data structures to use null-prototype objects or Map instances to reduce blast radius of prototype pollution.

4. 4

   Audit agent/RAG file ingestion pipelines

   Review any AI agent tools, RAG ingestion pipelines, or automated document processors that use exceljs-hardened to parse untrusted user-supplied spreadsheets, and apply the patch or sandbox the parsing process.

5. 5

   Runtime monitoring

   Deploy runtime application self-protection (RASP) or monitoring for anomalous Object.prototype modifications and unexpected process behavior following file uploads.

6. 6

   Dependency scanning

   Run software composition analysis (SCA) tools across CI/CD pipelines to detect vulnerable exceljs-hardened versions and enforce upgrade policies.