The exceljs-hardened library contains a prototype pollution vulnerability (CVE-2026-78207) in its deepMerge utility, specifically when processing cell notes from untrusted Excel files. The deepMerge function recursively merges objects without sanitizing proto or constructor property keys, allowing an attacker to pollute Object.prototype by embedding malicious property definitions in cell note objects within a crafted .xlsx file.
The 'hardened' branding creates a specific analytical problem: it suppresses the very scrutiny that security-conscious organizations should apply. When teams adopt a library explicitly marketed for protection, they rationally offload security considerations to that dependency. This cognitive offloading is precisely what allowed this vulnerability to persist—the deepMerge helper is low-level plumbing in a peripheral code path (cell note processing) that receives less audit attention, and the 'hardened' label further insulated it from review.
The CVSS 9.4 score warrants interrogation. Prototype pollution impact is context-dependent, but document-parsing pipelines present a distinct risk profile: Excel files arrive from external sources, get parsed into JavaScript objects, and those objects often persist in application memory. The attack chain—malicious JSON in cell notes merging into the runtime object system—does not require unusual deployment conditions. This is a realistic exploit path in any pipeline processing untrusted .xlsx files.
Architecturally, deepMerge should not exist in a document parser. The library should transform file bytes into inert data structures, not perform recursive object merging on parsed content. This represents structural overreach, not merely an implementation oversight. The remediation pattern has been known since 2019 (lodash CVE-2019-10744): explicit property allowlisting, not blocklisting proto checks.
Immediate actions: verify which version of exceljs-hardened is deployed and upgrade to the patched release. Audit all code paths that process cell notes—these are the vectors where untrusted input reaches deepMerge. Short of upgrading, validate or sanitize note objects before they enter the merge operation, though this imposes development overhead. Organizations that adopted exceljs-hardened specifically for its security claims face a coordination challenge: remediation requires updating a dependency that was chosen specifically because it was assumed to be safe, creating organizational inertia that extends the exposure window.