Junglewise Threat Intelligence

CVE-2026-85063: csv-parse prototype pollution via columns configuration

CVE-2026-85063 · Severity: medium · CVSS 6.9 · Published 2026-09-08

Executive brief

csv-parse is a popular Node.js library for parsing CSV data into structured objects. When configured with both the columns and group_columns_by_name options enabled, an attacker can inject a specially crafted CSV file with duplicate __proto__ headers to manipulate the JavaScript prototype chain of parsed records, potentially enabling arbitrary code execution or information disclosure depending on how the application processes the parsed data.

Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) in the csv-parse library's columns record builder. When parsing CSV with columns: true, the parser creates plain JavaScript objects using column names from the CSV header. With group_columns_by_name: true enabled, duplicate columns are handled by assigning an array to the duplicate key. If the duplicate column is named __proto__, the assignment to obj['__proto__'] invokes the __proto__ setter, replacing the record object's prototype with an attacker-controlled array. This occurs in the columns record builder in lib/api/index.js. An attacker controlling CSV input can exploit this by crafting a header row with duplicate __proto__ entries and corresponding CSV values to inject arbitrary properties or methods into parsed objects. The fix in version 7.0.2 adds Object.hasOwn duplicate checks and uses Object.defineProperty for assignment to prevent prototype setter invocation.

Affected products

  • adaltas csv-parse < 7.0.2

Timeline

  • 2026-08-02: disclosed: Issue #496 opened
  • 2026-08-02: patched: PR #497 merged, fix available in 7.0.2
  • 2026-09-08: advisory: GitHub Advisory GHSA-8cw4-87c7-c6xx published

References

Related threats