CVE-2026-9673: Versions of the package json-2-csv from 3

Synopsis

CSV Injection in the json-2-csv npm package (versions 3.15.0 through 5.5.11 exclusive) allows an attacker to bypass the preventCsvInjection option and embed malicious spreadsheet formulas into generated CSV output. The vulnerability is reached locally (no network access required) and requires no authentication or victim interaction to inject the payload, though a user must open the resulting CSV file in a spreadsheet application for the formula to execute. Successful exploitation lets the attacker run arbitrary spreadsheet formulas in the victim's spreadsheet application, enabling data exfiltration or unauthorized command execution within that application context. A patched-image rebuild at version 5.5.11 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the service is required to inject the malicious payload.

• AuthenticationNot required

  No credentials or account privileges are needed to craft or supply a malicious input that triggers the CSV injection.

• Victim interactionRequired

  A victim must open the generated CSV file in a spreadsheet application for the injected formula to execute.

• Attack complexityDetail

  The exploit is reliable and condition-free once malicious input reaches the json-2-csv conversion path; no race conditions or specific memory layout is required.

Blast Radius

• The attacker reads data accessible to the spreadsheet application at formula-execution time, including locally stored files or credentials exposed via spreadsheet functions.
• The attacker modifies or exfiltrates data by using spreadsheet formula capabilities such as external HTTP requests or file-read functions built into applications like Excel or LibreOffice Calc.
• Availability of the affected service itself is not impacted; the harm is confined to the spreadsheet application environment of whoever opens the file.