PT-2025-39315 · Csvtojson · Csvtojson

Published 2025-09-24 · Updated 2025-10-17 · CVE-2025-57350

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions csvtojson versions prior to 2.0.10

Description The csvtojson package has a flaw due to inadequate sanitization of nested header names during parsing. Processing CSV input with crafted header fields referencing prototype chains (like using proto) can unintentionally modify the base Object prototype. This can cause denial of service or unexpected behavior, especially when processing untrusted CSV data. The issue does not require user interaction beyond providing a malicious CSV file. The vulnerable component is parser jsonarray.

Recommendations Update to version 2.0.10 or later.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2025-57350

GHSA-VRW9-G62V-7FMF

Affected Products

Csvtojson

References · 12

• 🔥 https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57350 · Exploit
• https://github.com/Keyang/node-csvtojson/issues/498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-57350 · Security Note
• https://osv.dev/vulnerability/GHSA-vrw9-g62v-7fmf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-57350 · Vendor Advisory
• https://github.com/Keyang/node-csvtojson/issues/502 · Note
• https://github.com/Keyang/node-csvtojson/commit/4caeebd13b67be63282a7bbed3ca0cf9813f4bfc · Note
• https://github.com/Keyang/node-csvtojson · Note
• https://t.me/CVEtracker/33274 · Telegram Post
• https://t.me/cveNotify/139149 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JS-CSVTOJSON-13109616 · Note
• https://twitter.com/CVEnew/status/1970996104390115405 · Twitter Post