CVE-2026-9673 PUBLISHED

Assigner: snyk
Reserved: 27.05.2026 Published: 28.05.2026 Updated: 28.05.2026

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
CVSS Score: 7

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Local	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	Low	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	n/a
Product	json-2-csv
Versions	affected from 3.15.0 to 5.5.11 (excl.)

Credits

Ilsaf Nabiullin

References

https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326
https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410
https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613
https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229

Problem Types

CSV Injection