Vulnerability library
Security checkJanuary 27, 2026

CSVTOJSON has a prototype pollution vulnerability

Understand the exposure, see the recommended fix, and check whether your own website has related weaknesses.

Medium severitynpmcsvtojson

Check your website

Find this and other vulnerabilities with a free scan.

Your scan runs on your computer. No account required.

Description

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component.

Recommendation

Update the csvtojson package to the latest compatible version. Followings are version details:

  • Affected version(s): < 2.0.13
  • Patched version(s): 2.0.13

References

Could your website be exposed too?

SmartScanner can check your website for CSVTOJSON has a prototype pollution vulnerability and gives you actionable findings to investigate.

Start a free scan

Related Issues

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated January 27, 2026