CVE-2025-57350

The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

• CWE-1321

• https://github.com/Keyang/node-csvtojson/issues/498Issue Tracking, Vendor Advisory
• https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57350Third Party Advisory

Published

Sep 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-57330The web3-core-subscriptions is a package designed to manages…7.5
• CVE-2025-5734A vulnerability has been found in TOTOLINK X15 1.0.0-B202307…8.8
• CVE-2025-57347A vulnerability exists in the 'dagre-d3-es' Node.js package …9.8
• CVE-2025-57348The node-cube package (prior to version 5.0.0) contains a vu…6.5
• CVE-2025-57349The messageformat package, an implementation of the Unicode …7.5
• CVE-2025-5735A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.11…8.8
• CVE-2025-57351A prototype pollution vulnerability exists in the ts-fns pac…6.5
• CVE-2025-57352A vulnerability exists in the 'min-document' package prior t…5.3
• CVE-2025-57353The Runtime components of messageformat package for Node.js …5.3
• CVE-2025-57354A vulnerability exists in the 'counterpart' library for Node…6.5
• CVE-2025-5736A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.11…8.8
• CVE-2025-5737A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.11…8.8