CVE-2025-57350

What it actually does

Prototype pollution via unsanitized nested CSV header names in parser_jsonarray that allow modification of Object.prototype properties when processing untrusted input.

Why it matters to the business

Applications processing CSV data may experience denial of service or unpredictable behavior, increasing operational risk when handling external files.

How an attack unfolds

An attacker crafts a CSV file with header fields containing prototype references such as __proto__ and supplies it to any application using the vulnerable csvtojson library; the parser fails to sanitize these headers and mutates the base Object prototype, enabling subsequent DoS or logic abuse.

How to fix it

Upgrade keyang/node-csvtojson to commit abf5f59dce172d78adc3c62f4e9ff5b356e3565c or later equivalent to version 2.0.10; apply the corresponding Debian chromium package updates listed for each release.

How to confirm the fix worked

Confirm the installed csvtojson version meets or exceeds the fixed commit; test parsing of a CSV containing __proto__ headers and verify that Object.prototype remains unmodified.

Typical attack path

1. Identify an application endpoint or workflow that accepts CSV input using csvtojson.
2. Construct a malicious CSV containing header names that reference prototype chains.
3. Submit the CSV to the target application.
4. Trigger code paths that rely on unmodified prototype behavior to achieve DoS or unexpected results.

How to detect it

Review application logs for CSV parsing operations involving headers that contain prototype references; inspect error rates or unexpected object property changes after CSV ingestion.

What your security team should do

• Prioritize upgrade of all csvtojson instances to the fixed version within standard change windows.
• Inventory applications that ingest untrusted CSV and apply input validation or sandboxing until patched.
• Monitor dependency update feeds for downstream packages that embed csvtojson.