CVE-2026-9673
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
8th
Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.
| CWE | CWE-1236 |
| Vendor | n/a |
| Product | json-2-csv |
| Published | May 28, 2026 |
| Last Updated | May 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for n/a json-2-csv
Be the first to know when new medium vulnerabilities affecting n/a json-2-csv are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N/E:P Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
None
Affected Versions
n/a / json-2-csv
3.15.0 < 5.5.11
References
security.snyk.io: https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326 github.com: https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410 gist.github.com: https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613 github.com: https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229
Credits
Ilsaf Nabiullin