« Volver al listado

CVE-2025-57350

Estado: AnalizadaAlta (8.6)—

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype.

Leer descripción completaMostrar menos

This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota en librería Node.js (AV:N, PR:N, UI:N) accesible sin autenticación. Prototype pollution puede causar DoS modificando Object.prototype, afectando aplicaciones dependientes del paquete csvtojson < 2.0.10.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Network SegmentationFilter Network TrafficVulnerability ScanningRestrict File and Directory PermissionsPrivileged Account ManagementLimit Access to Resource Over Network

Tecnologías afectadas (1)

Keyangxiang — Csvtojson

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-57350",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-57350",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-24T19:13:57.201684Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.6,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-09-24T18:15:41.463",
  "references": [
    {
      "url": "https://github.com/Keyang/node-csvtojson/issues/498",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57350",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file."
    },
    {
      "lang": "es",
      "value": "El paquete csvtojson, una herramienta para convertir datos CSV a JSON con capacidades de análisis personalizables, contiene una vulnerabilidad de contaminación de prototipos en versiones anteriores a la 2.0.10. Este problema surge debido a una sanitización insuficiente de nombres de encabezado anidados durante el proceso de análisis en el componente parser_jsonarray. Al procesar entrada CSV que contiene campos de encabezado especialmente diseñados que hacen referencia a cadenas de prototipos (por ejemplo, usando la sintaxis __proto__), la aplicación puede modificar propiedades de forma no intencionada del prototipo base de Object. Esta vulnerabilidad puede conducir a condiciones de denegación de servicio o comportamiento inesperado en aplicaciones que dependen de cadenas de prototipos no modificadas, particularmente cuando se procesan datos CSV no confiables. La falla no requiere interacción del usuario más allá de proporcionar un archivo CSV construido maliciosamente."
    }
  ],
  "lastModified": "2026-06-17T09:43:03.410",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:keyangxiang:csvtojson:*:*:*:*:*:node.js:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CEAD2C8-EB0E-43A4-9F9C-F419B13F8056",
              "versionEndExcluding": "2.0.10"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}