GHSA-g27c-q7cp-mhx6

json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-9673

Packages

Ecosystem	Package	Affected	Fixed in
npm	json-2-csv	>= 3.15.0, < 5.5.11	5.5.11

Details

As written in the advisory (Markdown source, shown as plain text).

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-9673 advisory
https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229 web
https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613 web
https://github.com/mrodrig/json-2-csv package
https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410 web
https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326 web