UBUNTU-CVE-2026-85063

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-85063

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-85063.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-85063

Upstream

CVE-2026-85063

Published

2026-09-04T00:00:00Z

Modified

2026-09-05T06:15:42.852779213Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

node-csv is a full-featured CSV parser with a simple API that is tested against large datasets. Prior to 7.0.2, csv-parse with the columns and groupcolumnsby_name options enabled treats a duplicate proto header as an existing property in packages/csv-parse/lib/api/index.js, assigns an attacker-controlled array through obj['proto'], and replaces the parsed record object's prototype. A malicious CSV header can therefore inject inherited array values into the returned record, hide those inherited values from JSON serialization, and affect property enumeration and type or shape checks in applications that process the record. This issue is fixed in version 7.0.2.

References

Affected packages

Ubuntu:26.04:LTS / node-csv-parse

Package

Name: node-csv-parse
Purl: pkg:deb/ubuntu/node-csv-parse?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

6.*

6.0.0-1

6.1.0-1

Ecosystem specific

{
    "binaries": [
        {
            "binary_version": "6.1.0-1",
            "binary_name": "node-csv-parse"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-85063.json"