NPM: node-csv: Prototype replacement still reachable via columns path

NPM: node-csv: Prototype replacement still reachable via columns path vulnerability discovered by ? in WordPress Npm csv-parse versions 7.0.2...

EUVD-2026-70737

node-csv: Prototype replacement still reachable via columns path...

node-csv: Prototype replacement still reachable via columns path

Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj'proto', invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 Object.hasOwn duplicate...

GHSA-8CW4-87C7-C6XX node-csv: Prototype replacement still reachable via columns path

Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj'proto', invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 Object.hasOwn duplicate...

Linux Distros Unpatched Vulnerability : CVE-2026-85063

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbynam...

DEBIAN-CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

A flaw was found in node-csv, specifically within its csv-parse component. When configured with columns and groupcolumnsbyname options, a remote attacker can craft a malicious CSV header to manipulate the proto property. This allows the injection of attacker-controlled values into the parsed...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063 node-csv: Prototype replacement still reachable via columns path

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsbyname options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an...

CVE-2026-85063

node-csv (csv-parse) versions prior to 7.0.2 are vulnerable to a prototype replacement issue when the columns and group_columns_by_name options are enabled. In packages/csv-parse/lib/api/index.js, a duplicate __proto__ header in a CSV file is treated as an existing property, allowing an attacker-...

PT-2026-85253

Name of the Vulnerable Software and Affected Versions node-csv versions prior to 7.0.2 Description When the columns and group columns by name options are enabled, the csv-parse component treats a duplicate proto header as an existing property in the packages/csv-parse/lib/api/index.js file. This...