The vulnerability arises from the deepMerge helper in exceljs, which fails to reject special keys such as __proto__, constructor, or prototype when merging note objects. An attacker can supply a spreadsheet file with a malicious __proto__ property in a cell note. When processed, the library propagates that key into Object.prototype, polluting the global prototype chain. Because all plain objects constructed after the attack inherit from Object.prototype, subsequent code may behave unexpectedly or execute arbitrary code. This weakness is classified as CWE-1321.

The affected product is the ExcelJS JavaScript library. All releases through version 4.4.0, including 4.4.0 itself, are vulnerable. No specific vendor-supplied workarounds or patches are listed, and the issue is reported in the community repositories and advisories.

The CVSS score of 9.3 indicates a high severity risk. The EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploit campaigns have been documented. The attack vector is likely via ingestion of a malicious spreadsheet containing serialized cell notes with a __proto__ key. If the file is processed by the library, the prototype pollution will occur.