CVE-2026-9673

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-07-03
Weakness: CWE-1236

Description

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

Affected products

json-2-csv: from 3.15.0 before 5.5.11 — fixed in 5.5.11
org.webjars.npm:json-2-csv: all versions

How to fix

Upgrade to a fixed version: json-2-csv 5.5.11. Check the vendor advisory for mitigations.

References

https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613
https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410
https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229
https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17115116
https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326

Get alerted when CVE-2026-9673 or the next vulnerability affects your stack