Critical severity9.4NVD Advisory· Published Aug 24, 2026· Updated Aug 31, 2026

CVE-2026-78207

Description

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Exceljs Project/Exceljsllm-fuzzy
Range: <=4.4.0

Patches

Vulnerability mechanics

References

github.com/exceljs/exceljs/blob/v4.4.0/lib/utils/under-dash.jsnvd
github.com/mateocallec/exceljs-hardened/security/advisories/GHSA-qwr4-7h29-chpfnvd
www.vulncheck.com/advisories/exceljs-through-prototype-pollution-via-deepmerge-reached-from-note-serializationnvd

News mentions

No linked articles in our index yet.

cvss	0.611
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000