Read the docs
TI-2025-35520 Aliases CVE-2025-57350GHSA-vrw9-g62v-7fmf

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing…

Priority HIGH 76CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat.

Summary

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00313 24th percentileScored 2026-11-07
Fix Partial csvtojson (npm): 2.0.13Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—csvtojson (npm)before 2.0.132.0.13Patch availableGHSA-vrw9-g62v-7fmf
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • csvtojson (npm) Vendor— Affected before 2.0.13 Fixed in 2.0.13 Patch available GHSA-vrw9-g62v-7fmf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:keyangxiang:csvtojson:*:*:*:*:*:node.js:*:*before 2.0.10VulnerableKeyangxiang
  • cpe:2.3:a:keyangxiang:csvtojson:*:*:*:*:*:node.js:*:* Versions before 2.0.10 Vulnerable ·Keyangxiang

Remediation

  • Fix · GHSA-vrw9-g62v-7fmf csvtojson (npm) Fixed in 2.0.13 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logging Subsystem for Red Hat OpenShiftAffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-57350
  2. 2026-10-03 Alias added: GHSA-vrw9-g62v-7fmf

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences