Homepage

csv-parse@4.16.3

CSV parsing implementing the Node.js `stream.Transform` API

  • latest version

    7.0.2

  • latest non vulnerable version

    7.0.2

  • first published

    12 years ago

  • latest version published

    1 months ago

  • licenses detected

  • View csv-parse package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the csv-parse package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • M
    Prototype Pollution

    csv-parse is a parser converting CSV text input into arrays or objects.

    Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj['__proto__'] when a header contains duplicate __proto__ entries, triggering the __proto__ setter and replacing the parsed record object's prototype. An attacker can replace a record's prototype with attacker-controlled data, enabling object manipulation or code execution through the polluted prototype chain, by supplying CSV whose header carries duplicate __proto__ columns. This requires the application to parse untrusted CSV with both columns: true and group_columns_by_name: true enabled.

    How to fix Prototype Pollution?

    Upgrade csv-parse to version 7.0.2 or higher.

    <7.0.2
    Go back to all versions of this package