The exceljs library is susceptible to a critical prototype pollution vulnerability that could lead to unauthorized code execution or application instability.

This vulnerability resides in the deepMerge helper function, which fails to sanitize input keys such as proto, constructor, or prototype. An unauthenticated attacker can exploit this by providing a malicious JSON payload during note serialization, effectively polluting the global Object.prototype and influencing the behavior of all subsequent object instances within the application.

Successful exploitation of this flaw can lead to severe application compromise, including potential remote code execution or denial of service, depending on the surrounding application logic. Given the CVSS score of 9.4, this vulnerability represents a critical risk to data integrity and system availability, as prototype pollution often grants attackers the ability to bypass security controls or manipulate application state.

Immediate Action: Users should update to version 5.0.0 or later as soon as it becomes available from the official maintainers.

Proactive Monitoring: Security teams should monitor application logs for unexpected object property modifications or anomalous error patterns that may indicate attempts to pollute the prototype chain.

Compensating Controls: Implement strict input validation and sanitization for all user-supplied JSON data before it is processed by the exceljs library to prevent malicious keys from reaching the merge function.

Public Exploit Available: Unknown.

The high CVSS score of 9.4 highlights the severity of this prototype pollution vulnerability. Organizations utilizing the exceljs library must prioritize upgrading to the patched version once released and verify their dependency trees to ensure all instances of this library are remediated.