GitHub Advisoryadvisory · npm

GHSA-g27c-q7cp-mhx6 json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio

MEDIUM Published 2026-05-28 Modified 2026-07-01 Official page ↗
Aliases
CVE-2026-9673
Ecosystem
npm
Packages
json-2-csv
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-1236
Reviewed
2026-07-01

Affected packages

• npm json-2-csv: >= 3.15.0, < 5.5.11 → fixed in 5.5.11

Description

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

Related

Alias · CVE (1)

  • CVE-2026-9673 Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which… vulnerability

Weakness · CWE (1)

  • CWE-1236 Improper Neutralization of Formula Elements in a CSV File weakness

References