Snyk Security Database

csv-parse is a parser converting CSV text input into arrays or objects.

Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj['__proto__'] when a header contains duplicate __proto__ entries, triggering the __proto__ setter and replacing the parsed record object's prototype. An attacker can replace a record's prototype with attacker-controlled data, enabling object manipulation or code execution through the polluted prototype chain, by supplying CSV whose header carries duplicate __proto__ columns. This requires the application to parse untrusted CSV with both columns: true and group_columns_by_name: true enabled.

nltk is a Natural Language Toolkit (NLTK) is a Python package for natural language processing.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the XMLCorpusView._read_xml_fragment() function in nltk/corpus/reader/xmldocs.py. An attacker can exhaust CPU by supplying a malformed XML corpus file with a single oversized unterminated tag to an affected reader such as BNCCorpusReader.words(). The function reads the file in 1 KiB blocks and repeatedly rescans the entire growing fragment with _VALID_XML_RE.match() and fragment.rfind("<"), so processing time grows quadratically with input size. A user opening attacker-controlled corpus data sees excessive CPU consumption and a denial of service while the reader tries to parse the file.

org.webjars.npm:csv-parse is a parser converting CSV text input into arrays or objects.

Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj['__proto__'] when a header contains duplicate __proto__ entries, triggering the __proto__ setter and replacing the parsed record object's prototype. An attacker can replace a record's prototype with attacker-controlled data, enabling object manipulation or code execution through the polluted prototype chain, by supplying CSV whose header carries duplicate __proto__ columns. This requires the application to parse untrusted CSV with both columns: true and group_columns_by_name: true enabled.