CVE-2026-9673: Medium severity npm/json-2-csv vulnerability
Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
json-2-csvto a version that resolves this vulnerability.Fixed in 5.5.11 - Configuration
Upgrade json-2-csv to 5.5.11 to address CSV Injection; the preventCsvInjection option can be bypassed in versions 3.15.0 and before 5.5.11.
json-2-csv preventCsvInjection = use default behavior with the fix in 5.5.11 (option can be bypassed in versions 3.15.0 and before 5.5.11)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9673?
CVE-2026-9673 has a medium severity rating of 6.8.
How do I fix CVE-2026-9673?
To fix CVE-2026-9673, upgrade the json-2-csv package to version 5.5.11 or later.
What versions are affected by CVE-2026-9673?
CVE-2026-9673 affects json-2-csv versions from 3.15.0 up to, but not including, 5.5.11.
What kind of attack is associated with CVE-2026-9673?
CVE-2026-9673 is associated with CSV Injection attacks that allow an attacker to inject malicious formulas into CSV files.
What is the CVE-2026-9673 preventCsvInjection option?
The preventCsvInjection option is meant to mitigate CSV Injection, but it can be bypassed in versions affected by CVE-2026-9673.