What’s Vulnerable › Vulnerabilities

CVE-2025-57350

• Severity: high (CVSS 8.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-24 · updated 2026-06-17
• Weakness: CWE-1321

Description

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

Affected products

• Keyangxiang Csvtojson: before 2.0.10 — fixed in 2.0.10

How to fix

Upgrade to a fixed version: Keyangxiang Csvtojson 2.0.10. Check the vendor advisory for mitigations.

References

• https://github.com/Keyang/node-csvtojson/issues/498
• https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57350

Get alerted when CVE-2025-57350 or the next vulnerability affects your stack