exceljs-hardened Multiple Security Vulnerabilities

Prototype pollution in exceljs-hardened before 5.0.0 lets a remote attacker corrupt Object.prototype by feeding parsed JSON containing a malicious __proto__ property into a cell note, because the deepMerge helper in the note-serialization path fails to reject __proto__, constructor, or prototype keys. Any application that uses this library to process untrusted spreadsheet or note data is affected, and polluting the global prototype can cascade into denial of service, logic tampering, or code execution via downstream gadgets. No public exploit is identified at time of analysis, and the flaw is not listed in CISA KEV.

Unbounded xlsx decompression in exceljs-hardened before 5.0.0 allows unauthenticated remote attackers to exhaust server memory and cause denial of service by uploading a crafted zip-bomb workbook. The CVSS 4.0 score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) reflects that exploitation requires no authentication, no special configuration, and no victim interaction beyond the server automatically parsing the uploaded file. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit has been identified at time of analysis, but the zip-bomb technique targeting archive parsers is well-documented and requires minimal attacker skill.

Path traversal in exceljs-hardened before 5.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem by supplying crafted paths to the Workbook.addImage() function, which performs no input validation before passing the value to Node.js file system APIs. Any Node.js application that exposes this function to user-controlled input is at risk of exposing secrets, credentials, configuration files, and any other content readable by the process. No public exploit has been identified at time of analysis; vendor-released patch is available as version 5.0.0.

CSV formula injection in exceljs-hardened before version 5.0.0 allows attackers who can influence exported cell values to embed spreadsheet formulas in generated CSV output by supplying values beginning with =, +, -, or @. When a victim opens the resulting CSV in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, injected formulas execute in the spreadsheet context, enabling data exfiltration or unauthorized actions within that application. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.4 reflects high confidentiality impact and a scope change to the subsequent spreadsheet application system.