CVE-2026-9673CWE-1236

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed

High · published May 28, 2026

CVSS v4.0
7.0
EPSS
0%
Percentile
13.8
In the wild
Unconfirmed
What it is

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00236 · 13.8th percentile
Weakness
CWE-1236 · Improper Neutralization of Formula Elements in a CSV File
Published
2026-05-28T05:00Z
EPSS history
Timeline
  • 28 MAY 05:00Z
    Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed
    cvelistv5