CSV Injection Vulnerability in json-2-csv by mrodrig
CVE-2026-9673

7HIGH

Key Information:

Vendor

mrodrig

Status
Json-2-csv
Vendor
CVE Published:
28 May 2026

What is CVE-2026-9673?

Versions of the json-2-csv package prior to 5.5.11 are susceptible to a CSV Injection vulnerability caused by a bypass of the preventCsvInjection option. This vulnerability allows attackers to inject malicious formulas into CSV files. Upon opening these files in spreadsheet applications, the formulas can execute unintended actions, potentially leading to data leakage or manipulation.

Affected Version(s)

json-2-csv 3.15.0 < 5.5.11

References

https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326
https://github.com/mrodrig/json-2-csv/blob/main/src/json2...
https://gist.github.com/whoamins/299745a2d36b482b44e9613b...

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ilsaf Nabiullin
.