EUVD-2026-64682
GHSA-3cpv-r8x3-29fp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Reachable by feeding untrusted note data arriving over the network (AV:N/AC:L/PR:N/UI:N); the direct effect is prototype tampering (I:H), with confidentiality and availability impact only via downstream gadgets (C:L/A:L).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.
AnalysisAI
Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed JSON containing a malicious __proto__ property into a cell note, because the deepMerge helper in the note-serialization path fails to reject __proto__, constructor, or prototype keys. Any application that uses this library to process untrusted spreadsheet or note data is affected, and polluting the global prototype can cascade into denial of service, logic tampering, or code execution via downstream gadgets. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.
Technical ContextAI
The affected component is exceljs-hardened, a security-focused fork of the widely used exceljs JavaScript spreadsheet library, specifically its deepMerge utility (analogous to the under-dash.js merge helper referenced at lib/utils/under-dash.js#L155-L181). CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - prototype pollution) is the root-cause class: when merging attacker-influenced note objects, deepMerge recursively copies keys without filtering the dangerous __proto__, constructor, and prototype keys, so an attacker-supplied __proto__ object is walked into and its members are written onto Object.prototype rather than the target object. Because every plain JavaScript object inherits from Object.prototype, a single polluting merge silently alters the behavior of all objects created afterward in the same process. Note that the provided CPE (cpe:2.3:a:exceljs:exceljs:*) points at the upstream exceljs package, but the description and GHSA-qwr4-7h29-chpf attribute the flaw to the exceljs-hardened fork - that discrepancy should be verified against the vendor advisory.
RemediationAI
Vendor-released patch: 5.0.0 - upgrade exceljs-hardened to 5.0.0 or later, which rejects __proto__, constructor, and prototype keys during merge, per advisory GHSA-qwr4-7h29-chpf (https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qwr4-7h29-chpf). If immediate upgrade is not possible, sanitize untrusted spreadsheet and JSON note input before it reaches the library by stripping or rejecting any object containing __proto__, constructor, or prototype keys, and consider freezing the global prototype at process start with Object.freeze(Object.prototype) - with the trade-off that freezing can break libraries that legitimately mutate prototypes and will surface as thrown errors in strict mode. Where feasible, avoid parsing spreadsheet notes from untrusted sources, or isolate parsing in a short-lived worker/process so any prototype pollution cannot persist into the main request-handling context. Review the VulnCheck advisory (https://www.vulncheck.com/advisories/exceljs-through-prototype-pollution-via-deepmerge-reached-from-note-serialization) for the exact reachable path.
More in Prototype Pollution
View allPrototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. Rated critical severity (
Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to co
This affects the package ini before 1.3.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitabl
Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today