CVE-2025-57318

What it actually does

Prototype pollution in the toCsv function allows an attacker to inject arbitrary properties onto Object.prototype through a crafted payload, which can corrupt object behavior and lead to denial of service as the minimum impact.

Why it matters to the business

Applications relying on the library may experience unexpected crashes or service unavailability when processing untrusted input, increasing operational downtime and support costs until mitigated.

How an attack unfolds

An attacker identifies calls to the toCsv function that accept external data, crafts a malicious payload containing prototype-polluting keys, and supplies it to trigger property injection on the global prototype, resulting in DoS.

How to fix it

Upgrade csvjson to a version beyond 5.1.0 once a fix is released; in the interim, sanitize or validate all inputs passed to toCsv and consider replacing the library with a maintained alternative that performs safe serialization.

How to confirm the fix worked

Review package manifests and lockfiles for csvjson versions at or below 5.1.0; test the toCsv function with known prototype-pollution payloads in a controlled environment to confirm whether prototype properties are altered.

Typical attack path

1. Locate application code paths that invoke the toCsv function with user-controlled input
2. Craft a payload containing keys such as '__proto__' or 'constructor.prototype' with malicious values
3. Submit the payload through the affected input channel
4. Observe side effects that corrupt object instances and trigger application errors or crashes

How to detect it

Search application logs for toCsv invocations that include suspicious keys such as __proto__, examine error logs for prototype-related object corruption, and review any crash reports tied to object property access after CSV conversion.

What your security team should do

• Inventory all projects depending on csvjson and prioritize upgrades
• Implement input sanitization around toCsv calls as a temporary control
• Monitor vulnerability feeds for a published fix and schedule patching within standard change windows