Prototype Pollution in exceljs Spreadsheet Note Merging

exceljs-hardened before 5.0.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

Casky was already ahead

This CVE exploits attack patterns that Casky's 322matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Prototype pollution is a critical vulnerability that allows attackers to modify the Object.prototype of JavaScript applications by injecting malicious properties through data parsing. This CVE affects exceljs-hardened versions before 5.0.0, where the deepMerge helper function fails to sanitize __proto__, constructor, and prototype keys when processing cell notes in spreadsheets. Any application using vulnerable versions to parse untrusted Excel files becomes susceptible to prototype chain corruption, potentially leading to arbitrary code execution, authentication bypass, or complete application compromise. Organizations relying on exceljs for spreadsheet processing—particularly those handling user-uploaded files or processing data from external sources—face immediate risk.

Casky's 322 matching skills leverage Claude's extended reasoning to map this vulnerability across MITRE ATT&CK's initial access (TA0001) and resource development (TA0043) techniques. Practitioners using Casky would identify attack patterns including malicious file delivery vectors (T1566 - Phishing: Spearphishing Attachment) and detection of suspicious prototype property assignments during spreadsheet parsing. The platform's skills would flag deepMerge operations on untrusted JSON objects, trace data flow from cell note parsing through prototype modification, and surface indicators of exploitation such as unexpected Object.prototype mutations or unusual constructor access patterns. Security teams would see findings highlighting the specific merge operations vulnerable to prototype pollution, enabling rapid identification of at-risk code paths and implementation of input validation controls before object merging occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

322 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78207.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-78207

Casky has 322 skills that investigate the attack patterns behind CVE-2026-78207. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn