PT-2026-85253
CVE-2026-85063
·
Published
2026-09-03
·
Updated
2026-10-23
Description by
CVSS 4.0
6.9
MediumMetricsAV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
node-csv versions prior to 7.0.2
Description
When the
columns and group columns by name options are enabled, the csv-parse component treats a duplicate proto header as an existing property in the packages/csv-parse/lib/api/index.js file. This allows an attacker to assign a controlled array via obj[' proto '], replacing the prototype of the parsed record object. Consequently, a malicious CSV header can inject inherited array values into the returned record, hide these values from JSON serialization, and interfere with property enumeration and type or shape checks in applications processing the record.Recommendations
Update node-csv to version 7.0.2.
Found an issue in the description? Have something to add? Feel free to write us 👾