is it possible for an exit node to modify the data stream of a circuit, for example could a cell such as a padding cell be send down the stream after the data have been transmitted ?

i am thinking this is possible due to the binary modification attack, but am unsure if the exit node can only modify data, and not add cells

Thanks