CyberRota Analysis
AI-GeneratedThe deepMerge helper in exceljs-hardened versions prior to 5.0.0 is vulnerable to prototype pollution, allowing attackers to inject malicious __proto__ properties into cell notes. This can lead to unauthorized modification of Object.prototype, impacting all plain objects created thereafter and potentially compromising application integrity. Organizations using this library should prioritize patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.