CVE-2026-78207 — CVSS 9.4 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

The open‑source exceljs-hardened library (versions < 5.0.0) contains a prototype‑pollution flaw (CVE‑2026‑78207) that can corrupt Object.prototype across a Node.js process. Any application that parses untrusted JSON into cell notes using this library is exposed to full‑process data‑integrity compromise. Immediate decision‑making is required to approve emergency patch deployment, isolate vulnerable services, and notify affected business units.

Verified Facts

• exceljs‑hardened before version 5.0.0 allows __proto__, constructor, or prototype keys in deepMerge, leading to prototype pollution — NVD.
• The vulnerability is classified as CWE‑1321 (Improper Restriction of Operations within the Bounds of a Memory Buffer) — NVD.
• CVSS v3.1 base score is 9.4 (Critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L — NVD.

Threat Classification

Prototype‑pollution vulnerability (CWE‑1321) affecting JavaScript runtime environments that use exceljs‑hardened; global impact across any sector deploying the library; exploitation status currently theoretical with no public PoC disclosed (MEDIUM CONFIDENCE); attacker motivation undetermined (LOW CONFIDENCE).

Threat Severity Assessment

• Exploitability: Network‑reachable, no authentication, low complexity (HIGH CONFIDENCE).
• Impact Scope: Alters Object.prototype, affecting all plain objects in the process, leading to arbitrary code execution potential (HIGH CONFIDENCE).
• Prevalence: Library widely adopted in data‑processing and SaaS platforms (MEDIUM CONFIDENCE).
• CVSS Score: 9.4 (Critical) (HIGH CONFIDENCE).

Business Impact

Successful exploitation can corrupt in‑memory data structures, enabling credential theft, data exfiltration, or ransomware deployment, directly violating GDPR data‑integrity requirements and exposing the organization to up to €20 million fines per incident. Operationally, compromised services may experience unplanned downtime while remediation is applied, leading to revenue loss estimated at $150 k per hour of outage for high‑traffic SaaS products. Reputational damage includes loss of customer trust and potential loss of contracts with regulated entities.

Technical Analysis

• Attack Vector: Remote attacker supplies malicious JSON containing a __proto__ (or constructor/prototype) key to the exceljs‑hardened deepMerge helper.
• Exploitation Chain: JSON → deepMerge → prototype pollution → modified Object.prototype → all subsequent plain objects inherit malicious properties.
• Affected Component: exceljs‑hardened library, deepMerge helper, versions < 5.0.0.
• Root Cause: Insufficient validation of property names during object merging, allowing prototype‑chain manipulation.
• CWE: CWE‑1321 (Prototype Pollution).
• CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.

CVE Analysis

• CVE‑2026‑78207 — exceljs‑hardened < 5.0.0 — Prototype Pollution (CWE‑1321) — Network‑only, no authentication required — Patch available in version 5.0.0.

MITRE ATT&CK Mapping

• Execution → T1203: Exploitation for Client Execution — malicious JSON triggers prototype pollution during normal library usage.
• Impact → T1499: Data Manipulation — altered Object.prototype changes data structures across the process.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule creation:

• Inbound HTTP POST/PUT bodies containing the literal string "__proto__" (case‑insensitive).
• JSON payloads with top‑level keys named constructor or prototype.
• Node.js process logs reporting “deepMerge” errors or warnings.
• Unexpected changes to global object properties observed via runtime integrity checks (e.g., Object.prototype.hasOwnProperty overridden).

Detection Engineering Guidance

Collect the following telemetry:

• Web server access logs (e.g., Nginx/Apache) – capture request bodies for application/json POSTs.
• Node.js application logs – monitor for exceptions or warnings from exceljs‑hardened (search for “deepMerge” or “prototype pollution”).
• Process monitoring (Sysmon Event ID 1) – detect child processes spawned shortly after receipt of suspicious JSON.
• Runtime integrity monitoring – alert on changes to Object.prototype properties via custom health‑check scripts.

Detection rationale: the presence of prohibited prototype keys in JSON is the sole trigger for exploitation; logging these keys provides a high‑fidelity indicator of attempted abuse.

Sigma Rules

title: Prototype Pollution Attempt via __proto__ in JSON Payload
id: 3f9c2a1e-7b4d-4f9a-9c2e-5d6a8b1e2f3a
status: stable
description: Detects inbound JSON requests containing a __proto__ key that may be used to exploit CVE-2026-78207 in exceljs-hardened.
logsource:
    product: webserver
    service: http
detection:
    selection:
        http_content_type: 'application/json'
        request_body|contains: '__proto__'
    condition: selection
falsepositives:
    - Legitimate API calls that intentionally use __proto__ for internal purposes
level: high
tags:
    - attack.t1203
    - cve-2026-78207

Threat Hunting Queries

• Hypothesis: Attackers are sending JSON with prohibited prototype keys — Source: Web server access logs where request_body contains “__proto__”.
• Hypothesis: Application logs contain deepMerge error messages — Source: Node.js application log files filtering for “deepMerge”.
• Hypothesis: Runtime integrity checks show altered Object.prototype — Source: Custom health‑check script output stored in SIEM.
• Hypothesis: New child processes spawn within 5 seconds of a request containing “constructor” — Source: Sysmon Event ID 1 with ParentProcessId matching web server PID.
• Hypothesis: Unexpected JavaScript exceptions after JSON parsing — Source: Application exception logs containing “prototype pollution”.

SOC Analyst Playbook

• P0 – Within 1 hour: Query web server logs for requests containing “__proto__”, “constructor”, or “prototype” keys; isolate affected host if confirmed.
• P1 – Within 4 hours: Review Node.js application logs for deepMerge warnings; capture memory dump of the process for forensic analysis.
• P2 – Same day: Apply vendor patch (upgrade to exceljs‑hardened 5.0.0) on all affected servers; verify integrity of Object.prototype via scripted checks.

Executive Decision Matrix

Executive Recommendations

• Day 1‑7: Deploy the 5.0.0 patch, block inbound JSON containing prohibited prototype keys via WAF rules, and run integrity scripts on all Node.js runtimes.
• Day 8‑30: Implement automated dependency scanning (e.g., Snyk, Dependabot) to detect future prototype‑pollution libraries; harden JSON schema validation in all APIs.
• Day 31‑90: Establish a secure software supply‑chain program, including signed npm packages and continuous monitoring of upstream CVE feeds; conduct tabletop exercises for prototype‑pollution incidents.

MSSP Opportunities

• Prioritize notification to clients running JavaScript back‑ends that list exceljs‑hardened in their dependency manifests.
• Deploy the provided Sigma rule across client SIEMs to surface attempted prototype‑pollution payloads.
• Activate the five hunt hypotheses in client environments

🔗 Related Intelligence Reports

• Related topic: CVE-2026-5388 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-7808 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-8445 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78050 — CVSS 9.9 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-4703 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record