CVE-2026-85063: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in adaltas node-csv

The vulnerability in node-csv's csv-parse module (prior to version 7.0.2) involves improper handling of duplicate __proto__ headers when the columns and group_columns_by_name options are enabled. The code assigns an attacker-controlled array to obj['__proto__'], effectively replacing the prototype of the parsed record object. This prototype pollution allows injection of inherited array values that can be hidden from JSON serialization and interfere with property enumeration and type or shape validations in applications processing the CSV data. The vulnerability is identified as CWE-1321 and has a CVSS 4.0 base score of 6.9 (medium severity). The issue is resolved in node-csv version 7.0.2.

An attacker who can supply malicious CSV input with a crafted __proto__ header can manipulate the prototype of parsed record objects. This can lead to injection of unexpected inherited properties, which may bypass JSON serialization and affect application logic relying on property enumeration or type checks. The vulnerability does not require privileges or user interaction and can be exploited remotely via network. There are no known exploits in the wild at this time.

Upgrade node-csv to version 7.0.2 or later, where this prototype pollution vulnerability is fixed. No other mitigations are indicated by the vendor advisory.