Which versions of exceljs-hardened are affected by EUVD-2026-64682?

exceljs-hardened versions before 5.0.0 contain a critical prototype pollution vulnerability allowing remote attackers to corrupt application objects through malicious cell notes in spreadsheets,…

How to fix or mitigate EUVD-2026-64682?

Within 24 hours: Inventory all systems using exceljs-hardened before version 5.0.0 and map exposure surface; immediately restrict or disable processing of untrusted spreadsheet file uploads and cell note features where operationally feasible. Within 7 days: Deploy input validation filters explicitly blocking __proto__, constructor, and prototype property keys in cell note parsing; implement detailed logging and alerting for object property access anomalies; establish upgrade testing environment to prepare for vendor patch release. Within 30 days: Execute complete remediation through vendor-released patch deployment to exceljs-hardened 5.0.0 or later once available, or if patch remains unavailable, establish permanent defense-in-depth controls combining input filtering, least-privilege application execution, and continuous monitoring for prototype pollution attack patterns.

exceljs-hardened EUVD-2026-64682

Q: What is the CVSS score of EUVD-2026-64682?

EUVD-2026-64682 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

| CVE-2026-78207 CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2026-08-24 VulnCheck

GHSA-3cpv-r8x3-29fp

Information Disclosure Prototype Pollution Exceljs

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.6 HIGH

Reachable by feeding untrusted note data arriving over the network (AV:N/AC:L/PR:N/UI:N); the direct effect is prototype tampering (I:H), with confidentiality and availability impact only via downstream gadgets (C:L/A:L).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 24, 2026 - 01:03 vuln.today

CVE Published

Aug 24, 2026 - 00:30 cve.org

CRITICAL 9.3

DescriptionCVE.org

exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

AnalysisAI

Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed JSON containing a malicious __proto__ property into a cell note, because the deepMerge helper in the note-serialization path fails to reject __proto__, constructor, or prototype keys. Any application that uses this library to process untrusted spreadsheet or note data is affected, and polluting the global prototype can cascade into denial of service, logic tampering, or code execution via downstream gadgets. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.

Technical ContextAI

The affected component is exceljs-hardened, a security-focused fork of the widely used exceljs JavaScript spreadsheet library, specifically its deepMerge utility (analogous to the under-dash.js merge helper referenced at lib/utils/under-dash.js#L155-L181). CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - prototype pollution) is the root-cause class: when merging attacker-influenced note objects, deepMerge recursively copies keys without filtering the dangerous __proto__, constructor, and prototype keys, so an attacker-supplied __proto__ object is walked into and its members are written onto Object.prototype rather than the target object. Because every plain JavaScript object inherits from Object.prototype, a single polluting merge silently alters the behavior of all objects created afterward in the same process. Note that the provided CPE (cpe:2.3:a:exceljs:exceljs:*) points at the upstream exceljs package, but the description and GHSA-qwr4-7h29-chpf attribute the flaw to the exceljs-hardened fork - that discrepancy should be verified against the vendor advisory.

RemediationAI

Vendor-released patch: 5.0.0 - upgrade exceljs-hardened to 5.0.0 or later, which rejects __proto__, constructor, and prototype keys during merge, per advisory GHSA-qwr4-7h29-chpf (https://github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qwr4-7h29-chpf). If immediate upgrade is not possible, sanitize untrusted spreadsheet and JSON note input before it reaches the library by stripping or rejecting any object containing __proto__, constructor, or prototype keys, and consider freezing the global prototype at process start with Object.freeze(Object.prototype) - with the trade-off that freezing can break libraries that legitimately mutate prototypes and will surface as thrown errors in strict mode. Where feasible, avoid parsing spreadsheet notes from untrusted sources, or isolate parsing in a short-lived worker/process so any prototype pollution cannot persist into the main request-handling context. Review the VulnCheck advisory (https://www.vulncheck.com/advisories/exceljs-through-prototype-pollution-via-deepmerge-reached-from-note-serialization) for the exact reachable path.