CVE-2026-9673 describes a CSV Injection vulnerability in the json-2-csv package, affecting versions 3.15.0 and earlier 5.5.11. The vulnerability arises from a bypass of the preventCsvInjection option, enabling attackers to insert malicious spreadsheet formulas into CSV output. When these CSV files are opened in spreadsheet software, the injected formulas execute, which can lead to unintended command execution or data manipulation. The CVSS 4.0 vector indicates local attack vector with low complexity and no privileges or user interaction required, but with high impact on confidentiality and low impact on integrity. No vendor advisory or patch information is currently available.

An attacker can inject and execute spreadsheet formulas via CSV files generated by vulnerable versions of json-2-csv. This can lead to execution of arbitrary commands or data manipulation when the CSV is opened in spreadsheet applications. The impact is rated high due to the potential for malicious code execution through a commonly used data format.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening CSV files generated by affected versions in spreadsheet applications or apply manual sanitization to prevent formula injection. Monitor vendor channels for updates regarding patches or official mitigations.