GHSA-8cw4-87c7-c6xx: Npm/csv-parse vulnerability
Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).
Patches The problem been patched.
Workarounds Disable usage of both the columns and groupcolumnsbyname options.
References issue #496, PR #497
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/csv-parseto a version that resolves this vulnerability.Fixed in 7.0.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 7.0.2 - Configuration
Disable usage of the `columns` option (set `columns: false`).
Object columns parsing options columns = false - Configuration
Disable usage of the `group_columns_by_name` option (set `group_columns_by_name: false`).
Object columns parsing options group_columns_by_name = false
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using csv-parse with both the columns and group_columns_by_name options enabled are exposed when parsing CSV input containing a duplicated __proto__ header.
What must an attacker control to exploit the issue?
An attacker needs to supply CSV data with a duplicated __proto__ header. Under the affected option combination, the duplicate-column handling can replace the parsed record object's prototype with attacker-controlled data.
Is there a configuration workaround if updating is not immediately possible?
Yes. Disable use of both the columns and group_columns_by_name options.
Which version contains the fix?
The issue is fixed in version 7.0.2. The fix uses an Object.hasOwn duplicate check and Object.defineProperty assignment.