CVE-2026-9673 affects the json-2-csv package in versions from 3.15.0 up to and including 5.5.11. The vulnerability arises because the preventCsvInjection option, intended to prevent formula injection in CSV exports, can be bypassed. This enables an attacker to insert malicious formulas into CSV files, which may execute automatically when the files are opened in spreadsheet software. The CVSS 4.0 score is 7.0, indicating a high severity with local attack vector and no required privileges or user interaction.

An attacker can craft CSV files with injected formulas that execute upon opening in spreadsheet applications, potentially leading to unintended command execution or data manipulation. This could compromise the integrity or confidentiality of data processed by users opening the CSV files. However, exploitation requires local access to the CSV files and no privileges or user interaction are needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor vendor communications for updates and consider avoiding use of affected versions or disabling CSV import from untrusted sources until a fix is available.