CVE-2026-9673: CSV Injection in json-2-csv Library (Versions ≤5.5.10)

Technical summary

CVE-2026-9673 is a CSV injection vulnerability affecting json-2-csv library versions through 5.5.10. The preventCsvInjection security feature contains a bypass that fails to properly sanitize or block formula prefixes (such as =, +, -, @, and tab characters) before they are written to CSV output. An attacker controlling input to the JSON-to-CSV conversion process can craft payloads that reach the CSV file unfiltered. When the resulting CSV is imported into a spreadsheet application, the formula executes in the context of that application, potentially executing arbitrary commands or accessing sensitive data through the spreadsheet's formula language.

Business impact

Organizations using json-2-csv in data export pipelines face risks of data theft and lateral movement. If user-controlled data flows through json-2-csv without additional sanitization, attackers can embed formulas in exported reports or data files. When business users open these files in Excel, Sheets, or similar tools, the formulas execute silently, potentially stealing credentials, accessing linked data sources, or triggering further exploitation. The risk is particularly acute in SaaS platforms, data analytics tools, and business intelligence systems that export user-generated or third-party data as CSV.

Affected systems

Any application or service using json-2-csv library versions 3.15.0 through 5.5.10 is potentially affected. This includes Node.js applications that perform JSON-to-CSV conversion for data export functionality. The vulnerability does not affect the library itself in isolation; rather, it affects downstream systems when the generated CSV files are opened in spreadsheet applications. No specific vendor products are listed in the advisory, suggesting the impact is primarily on custom implementations and smaller open-source projects that depend on json-2-csv.

Exploitability

The vulnerability has a CVSS score of 6.8 (MEDIUM) and requires no network access or authentication. An attacker needs only the ability to influence JSON input to the conversion process—either through direct application access, an API endpoint, file upload, or data import feature. The barrier to exploitation is low; standard spreadsheet formula syntax is well-documented. However, the attack requires user interaction (opening the CSV file) and relies on a spreadsheet application's willingness to execute formulas, which some organizations may have disabled via security policies. The vulnerability is not currently tracked in the CISA KEV catalog, indicating no evidence of active exploitation in the wild.

Remediation

Update json-2-csv to version 5.5.11 or later, which includes a corrected preventCsvInjection implementation. If immediate upgrading is not feasible, implement secondary validation: sanitize all user-controlled data before passing it to json-2-csv, strip or escape formula prefix characters (=, +, -, @, tab) at the application level, or configure spreadsheet applications to disable automatic formula execution on import. Additionally, educate users to be suspicious of unexpected formulas in exported data files.

Patch guidance

Verify the current version of json-2-csv in your dependencies (npm list json-2-csv or check package-lock.json). Update to version 5.5.11 or later using npm update json-2-csv or yarn upgrade json-2-csv. After patching, re-export sample data containing formula-like strings to confirm they are no longer executed when opened in a spreadsheet. In a development environment, test with payloads such as =cmd|'/c calc'!A1 to verify the preventCsvInjection option now blocks them. For applications that cannot upgrade immediately, configure temporary input validation middleware that strips leading formula characters before data reaches the conversion function.

Detection guidance

Monitor for CSV export functions that receive suspicious input patterns resembling formulas (strings beginning with =, +, -, @, or tab characters, particularly those containing pipe characters, exclamation marks, or shell commands). Review application logs for unusual data export requests, especially those combining public-facing APIs with CSV generation. In networks where possible, monitor for users opening unexpected CSV files from external or suspicious sources and opening them in spreadsheet applications. Endpoint detection and response (EDR) tools can flag spreadsheet applications spawning child processes (a common outcome of formula-based code execution).

Why prioritize this

Although the CVSS score is MEDIUM (6.8), this vulnerability warrants prompt attention because it affects a widely-used data conversion library and requires no authentication or network access to exploit. The attack surface is broad in SaaS and cloud environments where CSV export is common. Delaying patching increases the window during which sophisticated attackers could craft targeted payloads for specific applications. However, it is not critical because it requires user interaction and is not currently being exploited in the wild.

Risk score, explained

The CVSS 3.1 score of 6.8 reflects: (1) local attack vector—only users with access to the application can send input to it; (2) low complexity—the bypass requires no special conditions or deep system knowledge; (3) no authentication required; (4) high confidentiality impact—formulas can exfiltrate data; (5) low integrity impact—formulas are limited in file-system modification without user interaction; (6) no availability impact. The score does not account for the requirement that a user must open the CSV file and allow formula execution, which in practice reduces risk for organizations with security policies disabling formula execution.

Frequently asked questions