CVE-2026-85063 Details
Description
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.
A vulnerability in the 'csv-parse' component of the 'node-csv' package, prior to version 7.0.2, allows for prototype injection through the handling of CSV headers. When the 'columns' and 'group_columns_by_name' options are enabled, a duplicate '__proto__' header is treated as a valid property. This mismanagement allows an attacker to inject an array into the parsed record object, replacing its prototype with an attacker-controlled one. The injected prototype can then be exploited to manipulate property enumeration and type checks, while also hiding certain data from JSON serialization.
Users can upgrade to 'csv-parse' version 7.0.2 or later, where this vulnerability has been patched. Alternatively, the 'columns' and 'group_columns_by_name' options can be disabled to avoid the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 3, 2026CISA-ADP
Assessed Sep 4, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/adaltas/node-csv/issues/496 | CISA-ADP | Issue TrackingTechnical DescriptionVendor |
| https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e | [email protected] | Source CodeVendor |
| https://github.com/adaltas/node-csv/issues/496 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/adaltas/node-csv/pull/497 | [email protected] | Issue TrackingVendor |
| https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| adaltas node-csv-parse | < 7.0.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 4, 2026 | CVE Modified | CISA-ADP |
| Sep 3, 2026 | New CVE Received | [email protected] |