PT-2026-44192 · Npm · Json-2-Csv

Ilsaf Nabiullin · Published 2026-05-28 · Updated 2026-05-29 · CVE-2026-9673

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions json-2-csv versions 3.15.0 through 5.5.10

Description CSV Injection occurs when the preventCsvInjection option is bypassed, allowing an attacker to inject formulas into CSV files. These formulas execute automatically when the files are opened in spreadsheet applications.

Recommendations Update to version 5.5.11 or later.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2026-9673

Affected Products

Json-2-Csv

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-9673 · Security Note
• https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229 · Note
• https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410 · Note
• https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613 · Note
• https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326 · Note
• https://t.me/cveNotify/164975 · Telegram Post
• https://t.me/cveNotify/165139 · Telegram Post