csvtojson up to 2.0.9 parser_jsonarray prototype pollution

Summaryinfo

A vulnerability described as problematic has been identified in csvtojson up to 2.0.9. This affects the function parser_jsonarray. Such manipulation leads to prototype pollution. This vulnerability is listed as CVE-2025-57350. In addition, an exploit is available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in csvtojson up to 2.0.9 and classified as problematic. Affected by this issue is the function parser_jsonarray. The manipulation with an unknown input leads to a prototype pollution vulnerability. Using CWE to declare the problem leads to CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. The impact remains unknown. CVE summarizes:

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

The advisory is available at github.com. This vulnerability is handled as CVE-2025-57350 since 08/17/2025. Technical details as well as a public exploit are known. This vulnerability is assigned to T1059 by the MITRE ATT&CK project.

The exploit is available at github.com. It is declared as proof-of-concept.

Upgrading to version 2.0.10 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2681). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• IBM App Connect Enterprise

Productinfo

Name

• csvtojson

Version

• 2.0.0
• 2.0.1
• 2.0.2
• 2.0.3
• 2.0.4
• 2.0.5
• 2.0.6
• 2.0.7
• 2.0.8
• 2.0.9

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion