CVE-2026-85063 in node-csv
Summary
by MITRE • 09/03/2026
node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and group_columns_by_name options enabled treats a duplicate __proto__ header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['__proto__'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in node-csv versions prior to 7.0.2 represents a critical prototype pollution attack vector within its CSV parsing logic, specifically affecting the csv-parse module when specific configuration options are enabled. The core technical flaw stems from how the parser handles column headers during data ingestion. When both the columns and group_columns_by_name options are active, the library processes incoming header names to map them directly onto JavaScript objects representing parsed records. In standard JavaScript environments, object property assignment can inadvertently modify the prototype chain if the target key corresponds to a built-in constructor property such as _proto_. The parser fails to sanitize or validate these keys against known dangerous properties before performing the assignment operation. Consequently, an attacker who controls the CSV input structure can inject a header named _proto_, causing the library to assign values directly to the object's prototype rather than its own properties. This behavior allows for remote code execution scenarios indirectly through data manipulation and enables significant integrity violations within applications relying on this parser for structured data ingestion.
The operational impact of this vulnerability is severe due to the pervasive nature of JavaScript object handling in modern web development frameworks. By successfully polluting the Object prototype, an attacker can inject inherited array values into every subsequent record parsed by the application after the malicious payload has been processed. This injection persists across multiple records because the modification affects the shared prototype rather than individual instances. Furthermore, these injected properties exhibit stealth characteristics; they are often hidden from standard JSON serialization methods like toJSON or JSON.stringify, which typically iterate over own enumerable properties and ignore inherited ones unless explicitly configured otherwise. However, while invisible to simple serialization, these values remain accessible through property enumeration techniques such as for...in loops or Object.getOwnPropertyNames when combined with prototype traversal logic. This discrepancy creates a dangerous state where the application's internal data model appears consistent during standard operations but contains hidden malicious payloads that can be exploited by downstream processes expecting clean, predictable object structures.
Security implications extend beyond simple data corruption to include potential bypasses of type checking and shape validation mechanisms within the consuming application. Many Node.js applications perform runtime checks on record shapes to ensure security policies or business logic constraints are met before processing further. If an attacker injects properties via prototype pollution, these injected values may satisfy certain truthiness checks or array-type validations without being present in the expected schema. This can lead to logical flaws where malicious data is processed as legitimate input, potentially leading to injection attacks if those values are later concatenated into SQL queries, command line arguments, or other sensitive contexts. The vulnerability aligns with CWE-1321: Improperly Controlled Modification of Object Prototype Attributes and falls under the MITRE ATT&CK technique T1559 - Inter-Process Communication, as it involves manipulating shared state between different parts of an application through object property manipulation. It also relates to CWE-787: Out-of-bounds Write in a broader sense regarding memory safety concepts adapted for high-level languages where prototype chains act as the underlying structure being overwritten.
Mitigation strategies primarily involve upgrading to version 7.0.2 or later, which implements strict validation of header names and prevents assignment to dangerous prototype keys such as _proto_, constructor, and prototype itself. For applications unable to upgrade immediately due to dependency constraints, defensive coding practices should be employed within the application layer. Developers can implement a custom pre-processing step that sanitizes CSV headers by stripping or renaming any values containing double underscores followed by proto, or by using Object.create(null) to create objects without prototypes when parsing records manually. Additionally, configuring parsers to use strict mode and validating input schemas against known safe property lists can reduce the attack surface. It is crucial for security teams to audit all instances of CSV parsing in their codebase, particularly those involving user-controlled headers, to ensure that no legacy configurations remain active with vulnerable library versions. Regular dependency scanning using tools like npm audit or Snyk should be integrated into CI/CD pipelines to detect such vulnerabilities early and prevent deployment of compromised components.