CSVTOJSON has a prototype pollution vulnerability

HIGH 8.6CVE-2025-57350 · GHSA-vrw9-g62v-7fmf · Published 24/09/2025 · updated 17/06/2026

In short

CVE-2025-57350 is a HIGH (CVSS 8.6) vulnerability affecting csvtojson (keyangxiang), csvtojson.
Chance of exploitation in the next 30 days (EPSS): 0.31%, higher than 24.3% of all vulnerabilities.
Fix: update to 2.0.10, 2.0.13 or later.

Package	Affected versions	Patched versions
csvtojson keyangxiang	`< 2.0.10`	`2.0.10`
csvtojson npm	`< 2.0.13`	`2.0.13`

Description

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using proto syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

NVD description

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

References

nvd.nist.gov/vuln/detail/CVE-2025-57350 · ADVISORY
Keyang/node-csvtojson · WEB
Keyang/node-csvtojson · WEB
Keyang/node-csvtojson commit 4caeebd · WEB
Keyang/node-csvtojson · PACKAGE
VulnSageAgent/PoCs · WEB
security.snyk.io/vuln/SNYK-JS-CSVTOJSON-13109616 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

csvtojson

keyangxiang

< 2.0.10

2.0.10

csvtojson

npm

< 2.0.13

2.0.13

Description

NVD description

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.