CVE-2026-9101: Prototype pollution in csv parsing
Prototype pollution in csv parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior leading to "1-click" command execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Require explicit user confirmation (do not automatically call shell.openExternal) before opening external file paths/URLs to prevent 1-click execution from crafted CSV imports.
Electron (shell.openExternal) prompt_before_openExternal = true - Compensating control
Disable or block CSV import of untrusted files and/or restrict CSV import functionality to trusted sources (e.g., only allow imports from authenticated internal locations or via an allowlist) until a code fix is available.
- Operational
Instruct users and administrators to avoid opening or importing CSV files from untrusted or unknown sources and to treat existing imported CSVs as potentially malicious until the vulnerability is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9101?
The severity of CVE-2026-9101 is medium with a score of 5.3.
How do I fix CVE-2026-9101?
To fix CVE-2026-9101, ensure that the csv parsing logic properly sanitizes and validates input data to prevent prototype pollution.
What are the potential impacts of CVE-2026-9101?
CVE-2026-9101 can lead to untrusted file paths being processed in shell.openExternal, potentially allowing for unauthorized command execution.
Who is affected by CVE-2026-9101?
Applications using vulnerable csv parsing logic for importing data are potentially affected by CVE-2026-9101.
When was CVE-2026-9101 published?
CVE-2026-9101 was published on May 20, 2026.