Exceljs - Exceljs - CRITICAL - CVE-2026-78207. The exceljs-hardened library prior to version 5.0.0 is susceptible to a prototype pollution vulnerability. This flaw exists in the deepMerge helper function, which inadequately filters specific keys such as __proto__, constructor, or prototype when merging note objects. An attacker may exploit this by inserting malicious JSON containing a harmful __proto__ property into cell notes. As a result, this can manipulate Object.prototype, leading to unintended modifications of all plain objects instantiated subsequently, thereby posing a significant security risk. Developers utilizing exceljs-hardened should promptly update to version 5.0.0 or later to mitigate this vulnerability.