VDB
Sign up
MEDIUM

GHSA-8cw4-87c7-c6xx

node-csv: Prototype replacement still reachable via columns path

Quick fix

GHSA-8cw4-87c7-c6xx — csv-parse: upgrade to the fixed version with the command below.

npm install csv-parse@7.0.2

Details

### Impact With columns: true and group_columns_by_name: true, a duplicated __proto__ header causes the duplicate-column branch to assign an array to obj['__proto__'], invoking the __proto__ setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment).

### Patches The problem been patched.

### Workarounds Disable usage of both the columns and group_columns_by_name options.

### References issue #496, PR #497

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/csv-parse
Introduced in: 0Fixed in: 7.0.2
Fixnpm install csv-parse@7.0.2

References