A prototype pollution vulnerability in the csvtojson package allows unauthenticated attackers to trigger denial of service or unexpected application behavior via malicious CSV input.

The flaw resides in the parser_jsonarray component, where insufficient sanitization of nested header names allows an unauthenticated attacker to inject prototype-altering payloads. By providing a specially crafted CSV file, an attacker can modify the base Object prototype, potentially disrupting application logic or causing service instability.

Successful exploitation of this vulnerability can lead to service disruption and potential application logic bypasses, posing a significant risk to data integrity and availability. With a CVSS score of 8.6, the vulnerability is classified as High severity, reflecting the potential for remote, unauthenticated exploitation that impacts core application functionality.

Immediate Action: Update the csvtojson package to version 2.0.13 or later to incorporate the necessary prototype sanitization fixes.

Proactive Monitoring: Monitor application logs for unusual CSV processing errors or unexpected runtime exceptions that may indicate attempts to pollute the prototype chain.

Compensating Controls: Implement strict input validation or sanitization on all user-supplied CSV files before they are passed to the parser_jsonarray component to neutralize malicious header payloads.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub repository maintained by VulnSageAgent.

Given the High severity rating and the availability of a public proof-of-concept, organizations using the csvtojson package must prioritize this update. Administrators should identify all applications utilizing this library and deploy the fixed version 2.0.13 immediately to eliminate the risk of prototype pollution and maintain system stability.