The vulnerability in exceljs-hardened prior to version 5.0.0 is a prototype pollution issue in the deepMerge helper. The function fails to filter out __proto__, constructor, or prototype keys when merging JSON note objects. An attacker can supply malicious JSON containing a __proto__ property to cell notes, resulting in modification of Object.prototype. This impacts all plain objects created subsequently, potentially leading to severe consequences such as arbitrary code execution or data corruption. The CVSS 3.1 score is 9.4 (critical), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity with low impact on availability. There are no known exploits in the wild and no patch information is provided in the source data.

Successful exploitation allows an attacker to modify the global Object.prototype in the JavaScript environment where exceljs-hardened is used. This can lead to widespread unexpected behavior in the application, including potential arbitrary code execution or data manipulation. The vulnerability affects confidentiality and integrity with a critical severity rating (CVSS 9.4). No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid processing untrusted JSON input with exceljs-hardened versions prior to 5.0.0. Monitor vendor channels for updates and apply patches promptly once released.