Listen to this Post
How CVE-2026-85063 Works
The `csv-parse` component of the `node-csv` library is a full-featured CSV parser that transforms CSV data into JavaScript objects or arrays. Prior to version 7.0.2, a prototype pollution vulnerability existed when two specific parsing options were enabled simultaneously: `columns: true` and group_columns_by_name: true.
Under normal operation, the `columns` option instructs the parser to treat the first CSV row as column names and use those names as object keys for each subsequent data row. The `group_columns_by_name` option, when enabled, groups duplicate column names by assigning their values into an array under the shared key.
The vulnerability is triggered when a malicious CSV header contains a duplicated `__proto__` column name. During parsing, the duplicate-column handling logic in `packages/csv-parse/lib/api/index.js` identifies the repeated `__proto__` header and attempts to group its values into an array. However, the code treats `__proto__` as a regular property key rather than a special prototype reference. When it assigns this array to obj['__proto__'], JavaScript’s internal `__proto__` setter is invoked.
This setter does not create a normal property named __proto__; instead, it replaces the entire prototype of the parsed record object with the attacker-controlled array. The array can contain arbitrary values (strings, numbers, objects) that the attacker embeds in the CSV data.
The consequences are subtle but dangerous. The polluted prototype causes the parsed record object to inherit array methods and properties from the attacker-supplied array. These inherited values are not visible during standard JSON serialization (since `JSON.stringify` skips prototype properties), making the pollution difficult to detect through routine logging or API responses. However, they affect property enumeration (for...in loops), type checks (Array.isArray may return unexpected results), and shape-based logic in applications that process the parsed records. An attacker can craft a CSV file that, when parsed by a vulnerable application, injects inherited values into the record objects, potentially leading to business logic bypasses, denial of service, or even remote code execution if the polluted properties are used in security-sensitive operations.
The issue was identified and fixed in version 7.0.2 by adding an `Object.hasOwn` duplicate check and using `Object.defineProperty` for safe assignment. Users are strongly advised to upgrade immediately or disable both `columns` and `group_columns_by_name` options as a temporary workaround.
DailyCVE Form:
Platform: node-csv (csv-parse)
Version: < 7.0.2
Vulnerability: Prototype Pollution
Severity: Moderate (CVSS 6.9)
date: 2026-09-08
Prediction: Patched in 7.0.2
What Undercode Say
Analytics:
- Attack Vector: Remote, via crafted CSV file
- Prerequisites: `columns: true` and `group_columns_by_name: true`
– Exploitability: Low complexity; no authentication required - Impact: Prototype pollution leading to logic bypass, DoS, or RCE in worst-case scenarios
- Fix Type: Patch (upgrade to 7.0.2) and workaround (disable options)
Bash Commands & Codes:
Check current version of csv-parse npm list csv-parse Upgrade to the patched version npm install [email protected] Verify upgrade npm list csv-parse
Vulnerable Code Snippet (simplified):
// Vulnerable logic in csv-parse < 7.0.2
if (options.columns && options.group_columns_by_name) {
// Duplicate column handling
if (obj[bash] !== undefined) {
// This branch is reached for duplicate '<strong>proto</strong>'
obj[bash] = [].concat(obj[bash], value);
// obj['<strong>proto</strong>'] triggers the prototype setter!
}
}
Exploit (Educational Purposes!):
<strong>proto</strong>,<strong>proto</strong> payload1,payload2 normal,data
When parsed with `columns: true` and group_columns_by_name: true, the first row causes the prototype of each record object to be replaced with ['payload1', 'payload2']. Subsequent rows inherit array methods and properties from this polluted prototype.
Protection:
- Immediate: Upgrade to `[email protected]` or higher.
- Workaround: Disable both `columns` and `group_columns_by_name` options if upgrading is not possible.
- Defensive Coding: Always validate and sanitize CSV headers; treat
__proto__,constructor, and `prototype` as forbidden keys. - Runtime Mitigation: Use `Object.create(null)` for parsed objects to avoid prototype inheritance, or run Node.js with `–disable-proto=throw` to prevent prototype mutations.
Impact:
- Confidentiality: Low – information disclosure via prototype inheritance.
- Integrity: Moderate – attackers can alter object behavior and logic.
- Availability: Moderate – potential DoS through unexpected type checks or infinite loops.
- Scope: Applications using `csv-parse` with the vulnerable options enabled are at risk. The pollution affects the entire Node.js process, making it a severe primitive for further exploitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
