CVE-2026-9673

CVSS 7 HIGHEPSS 0.2%CWE-1236

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

28 mai 2026Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

Produtos afetados

n/a · json-2-csv

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613 https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410 https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229 https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326