node-csv: Prototype replacement still reachable via columns path
GHSA-8cw4-87c7-c6xx · CVE-2026-85063
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
With columns: true and group_columns_by_name: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).
Patches
The problem been patched.
Workarounds
Disable usage of both the columns and group_columns_by_name options.
References
issue #496, PR #497
References
- WEB https://github.com/adaltas/node-csv/security/advisories/GHSA-8cw4-87c7-c6xx
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-85063
- WEB https://github.com/adaltas/node-csv/issues/496
- WEB https://github.com/adaltas/node-csv/pull/497
- WEB https://github.com/adaltas/node-csv/commit/eb4d1484589c976dcb977db8dd0b90e015a6f66e
- PACKAGE https://github.com/adaltas/node-csv
Ready to move
Start Securing
Free, no credit card | First findings in minutes