Skip to main content

node-csv CVE-2026-85063

| EUVDEUVD-2026-70737 MEDIUM
Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)
2026-09-03 GitHub_M GHSA-8cw4-87c7-c6xx
Code Injection Red Hat Prototype Pollution Node Csv Adaltas
6.9
CVSS 4.0 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.8 MEDIUM

AC:H reflects the non-default dual-option requirement (columns + group_columns_by_name); no privileges needed but attacker must control CSV content.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Red Hat
6.5 MEDIUM
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Sep 03, 2026 - 22:02 EUVD
Source Code Evidence Fetched
Sep 03, 2026 - 21:05 vuln.today
Analysis Generated
Sep 03, 2026 - 21:05 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 1,561 npm packages depend on csv-parse (190 direct, 1,380 indirect)

Ecosystem-wide dependent count for version 7.0.2.

DescriptionCVE.org

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.

AnalysisAI

Prototype pollution in node-csv's csv-parse package (prior to 7.0.2) allows unauthenticated remote attackers to inject inherited array values into parsed record objects by supplying a CSV with duplicate __proto__ column headers when both the columns and group_columns_by_name options are enabled. The parser's direct obj['__proto__'] assignment replaces the parsed record's prototype with an attacker-controlled array, causing inherited numeric-index values to be silently hidden from JSON.stringify(), corrupt property enumeration, and subvert type or shape checks in downstream application logic. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Both the columns option and the group_columns_by_name option must be explicitly enabled in the csv-parse invocation - neither is enabled by default. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The vendor-provided CVSS 4.0 score of 6.9 uses AC:L, which appears to understate the exploitation requirement: both the columns and group_columns_by_name options must be explicitly enabled together in the csv-parse call - neither is a default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade csv-parse to version 7.0.2 or later, which fully resolves the prototype pollution via the changes in commit eb4d1484589c976dcb977db8dd0b90e015a6f66e (https://github.com/adaltas/node-csv/pull/497). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Prototype Pollution

View all
CVE-2026-34621 HIGH POC
8.6 Apr 11

Prototype pollution in Adobe Acrobat Reader versions 24.001.30356, 26.001.21367 and earlier enables arbitrary code execu
CVE-2024-56059 CRITICAL
9.8 Dec 18

Prototype pollution in the farinspace Partners WordPress plugin (versions up to and including 0.2.0) enables remote unau
CVE-2020-28271 CRITICAL POC
9.8 Nov 12

Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service
CVE-2023-38894 CRITICAL POC
9.8 Aug 16

A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code vi
CVE-2024-24292 CRITICAL POC
9.8 Mar 28

A Prototype Pollution issue in Aliconnect /sdk v.0.0.6 allows an attacker to execute arbitrary code via the aim function
CVE-2023-26121 CRITICAL POC
10.0 Apr 11

All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper s
CVE-2021-23449 CRITICAL POC
10.0 Oct 18

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitr
CVE-2024-39011 CRITICAL POC
9.8 Jul 30

Prototype Pollution in chargeover redoc v2.0.9-rc.69 allows attackers to execute arbitrary code or cause a Denial of Ser
CVE-2024-38988 CRITICAL POC
9.8 Mar 28

alizeait unflatto <= 1.0.2 was discovered to contain a prototype pollution via the method exports.unflatto at /dist/inde
CVE-2025-57347 CRITICAL POC
9.8 Sep 24

A vulnerability exists in the 'dagre-d3-es' Node.js package version 7.0.9, specifically within the 'bk' module's addConf
CVE-2025-57321 CRITICAL POC
9.8 Sep 24

A Prototype Pollution vulnerability in the util-deps.addFileDepend function of magix-combine-ex versions thru 1.2.10 all
CVE-2024-45435 CRITICAL POC
9.8 Aug 29

Chartist 1.x through 1.3.0 allows Prototype Pollution via the extend function. Rated critical severity (CVSS 9.8), this

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all
CVE-2026-34621 HIGH POC
8.6
CVE-2024-56059 CRITICAL
9.8
CVE-2020-28271 CRITICAL POC
9.8
CVE-2023-38894 CRITICAL POC
9.8
CVE-2024-24292 CRITICAL POC
9.8
CVE-2023-26121 CRITICAL POC
10.0
CVE-2021-23449 CRITICAL POC
10.0
CVE-2024-39011 CRITICAL POC
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Vendor StatusVendor

Share

CVE-2026-85063 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy