The vulnerability lies in the deepMerge helper of exceljs and allows an attacker to inject a malicious __proto__ property into cell notes. This exploitation path modifies Object.prototype and consequently alters every plain object constructed in the application. Because the prototype chain is altered, the attacker can introduce arbitrary properties that may be later accessed by the application, potentially leading to unintended behavior or code execution. The weakness is classified as CWE‑1321.

The affected product is the ExcelJS JavaScript library (exceljs). All releases before version 4.4.0 are vulnerable, including the pre‑4.4.0 releases of both the standard exceljs library and the hardened variant prior to 5.0.0.

The CVSS score of 9.3 indicates high severity. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, implying that no widespread exploitation is documented yet. The attack vector is most likely through ingestion of a malicious spreadsheet file containing serialized cell notes with a __proto__ key. Once the file is processed, the library’s deepMerge function fails to sanitize the key, allowing the attacker to pollute the global Object prototype. This high severity plus the lack of existing mitigations makes the risk significant for any application that loads untrusted Excel files.