CVE-2025-57350
Keyangxiang Csvtojson ≤ 2.0.10
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:LCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-57350 is a high-severity Prototype Pollution (CWE-1321) vulnerability in Keyangxiang Csvtojson. Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-57350 is a prototype pollution vulnerability in the csvtojson package, a Node.js tool for converting CSV data to JSON with customizable parsing capabilities, affecting versions prior to 2.0.10. The flaw occurs in the parser_jsonarray component due to insufficient sanitization of nested header names during CSV parsing. Specially crafted header fields referencing prototype chains, such as those using __proto__ syntax, can unintentionally modify properties of the base Object prototype when processing malicious CSV input.
Remote attackers require no privileges or user interaction beyond supplying a malicious CSV file to exploit this vulnerability over the network with low complexity. Exploitation can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, especially those processing untrusted CSV data. The CVSS v3.1 base score is 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), reflecting high confidentiality impact alongside low integrity and availability impacts, and it is associated with CWE-1321.
Advisories recommend upgrading to csvtojson version 2.0.10 or later to mitigate the issue through improved sanitization. Further details are documented in the GitHub issue at https://github.com/Keyang/node-csvtojson/issues/498, with a proof-of-concept available at https://github.com/VulnSageAgent/PoCs/tree/main/JavaScript/prototype-pollution/CVE-2025-57350.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31040
Vulnerability Data
The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process…
more
in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.3.6
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and safe property assignment to prevent prototype pollution.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches prototype-pollution flaws before release.
Secure coding standards directly prohibit unsafe prototype attribute assignment and require defensive checks.
Change-management processes ensure security fixes for prototype-pollution issues are tracked and deployed.