Summary
node-csv: Prototype replacement still reachable via columns path
Advisory details
Impact
With columns: true and group_columns_by_name: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).
Patches
The problem been patched.
Workarounds
Disable usage of both the columns and group_columns_by_name options.
References
issue #496, PR #497
References
- https://github.com/advisories/GHSA-8cw4-87c7-c6xx
- https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx
- https://nvd.nist.gov/vuln/detail/CVE-2026-85063
- https://github.com/adaltas/node-csv/issues/496
- https://github.com/adaltas/node-csv/pull/497
- https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-107301
msgpack5: Partial options disable prototype protection
- HIGHCVE-2026-105858
Payload: Remote Code Execution through first-register
- CRITICALCVE-2026-105857
Payload Form Builder has an RCE issue
- CRITICALCVE-2026-105844
Payload: Prototype pollution in Payload Import Export plugin
- HIGHCVE-2026-104852
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
- CRITICALCVE-2026-104848
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution