Vulnerability in Full-Featured CSV Parser Affecting Node-CSV by Adaltas

CVE-2026-85063

What is CVE-2026-85063?

The node-csv package, a widely-used CSV parser, is vulnerable to prototype pollution due to improper handling of duplicate 'proto' headers in parsed CSV data. Attackers can exploit this flaw by injecting malicious CSV headers, which allows them to replace the prototype of parsed record objects with an attacker-controlled array. This can lead to significant security concerns, including the ability to manipulate property enumeration, JSON serialization, and type checks within affected applications. The issue has been resolved in version 7.0.2 with appropriate sanitization measures.

References