exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

exceljs-hardened versions before 5.0.0 contain a prototype pollution vulnerability in the deepMerge helper function. The vulnerability arises because the helper fails to reject dangerous keys such as __proto__, constructor, or prototype when merging note objects. Attackers can exploit this by assigning parsed JSON with a malicious __proto__ property to cell notes. This allows modification of Object.prototype, which affects all plain objects created during the process. The vulnerability is reachable via note serialization in spreadsheet processing. A fix is available in exceljs-hardened version 5.0.0 and above. The issue originates in the under-dash.js utility file in the upstream exceljs library. A GitHub Security Advisory (GHSA-qwr4-7h29-chpf) has been published for this vulnerability. VulnCheck has also documented this issue in their advisories.