~ / search / GHSA-8cw4-87c7-c6xx

GHSA-8cw4-87c7-c6xx

node-csv: Prototype replacement still reachable via columns path

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-85063

Packages

EcosystemPackageAffectedFixed in
npm csv-parse < 7.0.2 7.0.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact With columns: true and group_columns_by_name: true, a duplicated __proto__ header causes the duplicate-column branch to assign an array to obj['__proto__'], invoking the __proto__ setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment). ### Patches The problem been patched. ### Workarounds Disable usage of both the columns and group_columns_by_name options. ### References issue #496, PR #497

References

External links from the advisory. They lead to third-party sites.