THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-8cw4-87c7-c6xx (medium) — node-csv: Prototype replacement still reachable via columns path

[GHSA] GHSA-8cw4-87c7-c6xx (medium) — node-csv: Prototype replacement still reachable via columns path

medgithub_advisoriesPublished 2026-09-08

GHSA-8cw4-87c7-c6xx Severity: medium CVE: CVE-2026-85063

node-csv: Prototype replacement still reachable via columns path

### Impact With columns: true and group_columns_by_name: true, a duplicated __proto__ header causes the duplicate-column branch to assign an array to obj['__proto__'], invoking the __proto__ setter and replacing the parsed record object's prototype with attacker-controlled d

Indicators of compromise

CVE-2026-85063cve

Original source: https://github.com/advisories/GHSA-8cw4-87c7-c6xx