PT-2026-44192 · Npm · Json-2-Csv

Ilsaf Nabiullin · CVE-2026-9673 · Published 2026-05-28 · Updated 2026-07-03

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions json-2-csv versions 3.15.0 through 5.5.10

Description CSV Injection occurs when the preventCsvInjection option is bypassed, allowing an attacker to inject formulas into CSV files. These formulas execute automatically when the files are opened in spreadsheet applications.

Recommendations Update to version 5.5.11 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2026-9673

GHSA-G27C-Q7CP-MHX6

Affected Products

Json-2-Csv

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9673.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-9673 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g27c-q7cp-mhx6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9673 · Security Note
• https://github.com/mrodrig/json-2-csv · Note
• https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410 · Note
• https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229 · Note
• https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326 · Note
• https://t.me/cveNotify/165139 · Telegram Post
• https://t.me/cveNotify/164975 · Telegram Post
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17115116 · Note
• https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613 · Note
• https://t.me/cveNotify/185875 · Telegram Post