json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio

GHSA-g27c-q7cp-mhx6 · CVE-2026-9673

Published May 28, 2026 · Modified Jul 3, 2026

Description

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-9673
WEB https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229
WEB https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613
PACKAGE https://github.com/mrodrig/json-2-csv
WEB https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410
WEB https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes