CSVTOJSON has a prototype pollution vulnerability

Description

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component.

Recommendation

Update the csvtojson package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.13
• Patched version(s): 2.0.13

References

• GHSA-vrw9-g62v-7fmf
• security.snyk.io
• CVE-2025-57350
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - CVE-2025-13465
• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash.unset - CVE-2025-13465
• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-es - CVE-2025-13465
• Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - lodash-amd - CVE-2025-13465

You might also like:

Exploiting Server Version Disclosure

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

Tags:

npm

csvtojson