Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are open…

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-9673 · CVE overview and exploitation status

EUVD-2026-32721

GHSA-g27c-q7cp-mhx6

cve-program · CVE-2026-9673

• https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17115116
• https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410
• https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613
• https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229

euvd · EUVD-2026-32721

• https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17115116
• https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410
• https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613
• https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229

nvd · CVE-2026-9673

• https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613
• https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410
• https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229
• https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-17115116
• https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326

osv · GHSA-g27c-q7cp-mhx6

• https://nvd.nist.gov/vuln/detail/CVE-2026-9673
• https://github.com/mrodrig/json-2-csv/commit/0fdd0bb6d0273178cd940afc323ccbce19688229
• https://gist.github.com/whoamins/299745a2d36b482b44e9613b78e40613
• https://github.com/mrodrig/json-2-csv
• https://github.com/mrodrig/json-2-csv/blob/main/src/json2csv.ts%23L410
• https://security.snyk.io/vuln/SNYK-JS-JSON2CSV-14221326

No related changes are available here.