CVE-2026-9673highCWE-1236

CVE-2026-9673

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7epss 0.2%

probabilidad de explotación

0.2%top 94% de las CVE

explotación observada

noninguna fuente lo reporta

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Productos afectados

n/a · json-2-csv n/a · org.webjars.npm:json-2-csv

Referencias

https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613 https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410 https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229 https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17115116 https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326