CVE-2026-85063

Received Received - Intake

Prototype Pollution in node-csv CSV Parser

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-03

Last Modified

2026-09-03

Generated

2026-09-04

AI Q&A

2026-09-04

EPSS Evaluated

N/A

NVD

CVE-2026-85063

Affected Vendors & Products

Vendor	Product	Version / Range
csv_parse	csv_parse	7.0.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

The vulnerability in node-csv before version 7.0.2 allows an attacker to manipulate CSV parsing by including a duplicate __proto__ header. This can cause the parser to replace the prototype of parsed record objects with an attacker-controlled array, enabling prototype pollution. This affects how the data is processed and can lead to unexpected behavior in applications.

Detection Guidance

To detect this vulnerability, check if your system uses node-csv versions prior to 7.0.2. Run: npm list csv-parse or npm list node-csv. If the version is below 7.0.2, the system is vulnerable.

Impact Analysis

This vulnerability can impact you by allowing attackers to inject malicious data into your application's objects. This could lead to data corruption, unexpected behavior in property checks, or bypassing security mechanisms. Applications using affected versions of node-csv with specific parsing options are at risk.

Mitigation Strategies

Upgrade node-csv to version 7.0.2 or later. Run: npm update csv-parse or npm install csv-parse@latest. Verify the update with npm list csv-parse.

Hi! I’m here to help you understand CVE-2026-85063. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70