PT-2026-85253
CVE-2026-85063
·
تاريخ النشر
2026-09-03
·
تاريخ التحديث
2026-10-23
الوصف من
CVSS 4.0
6.9
متوسطةالمقاييسAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
node-csv versions prior to 7.0.2
Description
When the
columns and group columns by name options are enabled, the csv-parse component treats a duplicate proto header as an existing property in the packages/csv-parse/lib/api/index.js file. This allows an attacker to assign a controlled array via obj[' proto '], replacing the prototype of the parsed record object. Consequently, a malicious CSV header can inject inherited array values into the returned record, hide these values from JSON serialization, and interfere with property enumeration and type or shape checks in applications processing the record.Recommendations
Update node-csv to version 7.0.2.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾