CVE-2026-85063: 
JavaScript vulnerability analysis and mitigation

CVE-2026-85063 is a prototype pollution vulnerability in the csv-parse component of the node-csv npm package (by adaltas), affecting all versions prior to 7.0.2. When both the columns: true and group_columns_by_name: true options are enabled, a malicious CSV file with a duplicate __proto__ header column causes the parser to assign an attacker-controlled array to obj['__proto__'], replacing the parsed record object's prototype. This is an incomplete fix of a prior related issue (#479). The vulnerability was disclosed on August 2, 2026, with a patch released the same day in version 7.0.2. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). In packages/csv-parse/lib/api/index.js, the duplicate-column detection used obj[columns[i].name] !== undefined rather than Object.hasOwn(obj, columns[i].name), meaning the inherited __proto__ property was treated as an existing own property. When group_columns_by_name: true is active and a duplicate __proto__ column appears, the code converts the value to an array and assigns it via obj['__proto__'] = [...], which invokes the __proto__ setter and replaces the record object's prototype with an attacker-controlled array. The fix in 7.0.2 uses Object.hasOwn() for the duplicate check and Object.defineProperty() for assignment, preventing the setter from being invoked (GitHub Issue #496, GitHub PR #497, Commit eb4d148).

Successful exploitation allows an unauthenticated attacker to inject an attacker-controlled array as the prototype of parsed record objects. The impact is object-local (not global Object.prototype pollution), but has meaningful downstream consequences: injected values are hidden from JSON.stringify() serialization, for...in enumeration exposes attacker-controlled keys and values, and type/shape checks (e.g., rec.length, array method inheritance while Array.isArray(rec) returns false) are corrupted. Applications that rely on the integrity of parsed CSV records for authorization decisions, data validation, or type checking are most at risk (GitHub Issue #496, GitHub Advisory).

A proof-of-concept exploit is publicly available on GitHub (issue #496), demonstrating the vulnerability with a minimal JavaScript snippet (GitHub Issue #496). The vulnerability is network-exploitable, requires no authentication or user interaction, and is classified as automatable by NVD SSVC. The EPSS score is approximately 0.325%, indicating a low but non-negligible probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Identify target: Find an application that uses csv-parse (node-csv) version < 7.0.2 with both columns: true and group_columns_by_name: true options enabled, and accepts CSV input from user-controlled sources (e.g., file uploads, API endpoints).
2. Craft malicious CSV: Construct a CSV payload with a duplicate __proto__ header and attacker-controlled values in the corresponding columns, e.g.:

__proto__,__proto__,role
EVIL1,EVIL2,admin

3. Submit payload: Deliver the malicious CSV to the target application via the relevant input vector (file upload, HTTP request body, etc.).
4. Trigger prototype replacement: When csv-parse processes the CSV, the duplicate-column branch assigns ['EVIL1', 'EVIL2'] to obj['__proto__'], replacing the parsed record's prototype with the attacker-controlled array.
5. Exploit downstream effects: The returned record object now has an attacker-controlled prototype. Exploit consequences include: JSON.stringify(record) omits the injected values (hiding them from logging/auditing), for...in loops expose attacker-injected keys, and record.length / array method checks behave unexpectedly — potentially bypassing type checks or shape validation in the application (GitHub Issue #496, GitHub PR #497).

• Network: Unexpected CSV file uploads or API requests containing __proto__ as a column header value; repeated submissions of CSV data with duplicate column names to endpoints that process CSV input.
• Logs: Application logs showing CSV parsing of records where __proto__ appears as a field name; anomalous serialization output (e.g., JSON.stringify results missing expected fields from parsed CSV records).
• Application Behavior: Unexpected results from type/shape checks on parsed CSV records (e.g., Array.isArray returning false on objects with array-like properties); for...in loops on parsed records yielding unexpected keys not present in the CSV header; record.length returning a non-undefined value on plain parsed objects.

Upgrade csv-parse (node-csv) to version 7.0.2 or later, which resolves the issue by using Object.hasOwn() for duplicate-column detection and Object.defineProperty() for property assignment, preventing the __proto__ setter from being invoked (GitHub Advisory, Commit eb4d148). If immediate patching is not possible, disable the group_columns_by_name option (the vulnerability requires both columns: true and group_columns_by_name: true to be active simultaneously). Additionally, validate and sanitize CSV headers before parsing to reject any column named __proto__, constructor, or prototype as a defense-in-depth measure (Feedly).

The vulnerability was reported by researcher hackchang via GitHub issue #496 on August 2, 2026, who noted it was an incomplete fix of a prior related issue (#479, rated CVSS 6.5). The maintainer (wdavidw) merged the fix the same day via PR #497. The issue attracted attention from downstream projects, with at least one third-party project (skkuverse-server) explicitly citing the fix as a reason for upgrading to csv-parse 7.0.2 (GitHub PR #497, GitHub Issue #496).