CVE-2025-57350: Keyangxiang Csvtojson DOS Vulnerability

CVE-2025-57350 Overview

The csvtojson package, a popular Node.js tool for converting CSV data to JSON with customizable parsing capabilities, contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to insufficient sanitization of nested header names during the parsing process in the parser_jsonarray component. When processing CSV input containing specially crafted header fields that reference prototype chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base Object prototype.

This vulnerability can lead to denial of service conditions or unexpected behavior in applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed. The flaw does not require user interaction beyond providing a maliciously constructed CSV file.

Critical Impact

Attackers can exploit this prototype pollution vulnerability to cause denial of service or manipulate application behavior by injecting malicious properties into Object.prototype through crafted CSV headers.

Affected Products

• keyangxiang csvtojson versions prior to 2.0.10
• Node.js applications using vulnerable csvtojson package
• Systems processing untrusted CSV data with csvtojson

Discovery Timeline

• 2025-09-24 - CVE-2025-57350 published to NVD
• 2025-10-17 - Last updated in NVD database

Technical Details for CVE-2025-57350

Vulnerability Analysis

This vulnerability is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes), commonly known as prototype pollution. The flaw exists in the parser_jsonarray component of the csvtojson library, which fails to properly sanitize CSV header names before using them as object property keys during the JSON conversion process.

When the parser encounters nested header notation in CSV files, it processes these headers to create hierarchical JSON structures. However, the implementation does not adequately filter out special JavaScript property names such as __proto__, constructor, or prototype. This allows an attacker to craft CSV files with headers that, when parsed, modify the base Object prototype rather than creating legitimate nested properties.

The network-accessible nature of this vulnerability means any application that accepts CSV files from external sources and processes them with the vulnerable csvtojson library is at risk. No authentication or special privileges are required to exploit this flaw—simply providing a malicious CSV file is sufficient.

Root Cause

The root cause of this vulnerability lies in the insufficient input validation and sanitization of CSV header names in the parser_jsonarray component. The parser dynamically creates nested object properties based on header notation without checking if the header names correspond to sensitive JavaScript prototype chain properties.

When a header such as __proto__.polluted is encountered, the parser treats it as a legitimate nested property path and assigns values to it, inadvertently modifying Object.prototype. This affects all objects in the JavaScript runtime that inherit from Object.prototype, potentially causing widespread application instability.

Attack Vector

The attack vector for this vulnerability is network-based, requiring an attacker to submit a maliciously crafted CSV file to an application using the vulnerable csvtojson library. The attack flow typically involves:

1. An attacker creates a CSV file with headers containing prototype chain references (e.g., __proto__.maliciousProperty)
2. The malicious CSV is submitted to a target application that processes CSV files using csvtojson
3. The parser processes the header and assigns values to the prototype chain
4. All JavaScript objects in the application are affected by the polluted prototype
5. Depending on the polluted property, this can cause denial of service, security bypasses, or unexpected application behavior

For technical details and proof-of-concept examples, see the GitHub PoC Repository.

Detection Methods for CVE-2025-57350

Indicators of Compromise

• Unexpected properties appearing in JavaScript objects that were not explicitly defined
• Application crashes or errors related to undefined behavior in prototype chain operations
• Log entries showing CSV files with suspicious header names containing __proto__, constructor, or prototype
• Anomalous application behavior after processing CSV files from external sources

Detection Strategies

• Implement file integrity monitoring for CSV files processed by the application
• Deploy runtime application self-protection (RASP) solutions that detect prototype pollution attempts
• Monitor application logs for parsing errors or unusual property access patterns
• Use static analysis tools to identify vulnerable csvtojson versions in dependencies
• Implement input validation to detect and reject CSV files with suspicious header patterns

Monitoring Recommendations

• Enable verbose logging for CSV parsing operations to capture header names being processed
• Set up alerts for dependency scanning tools to flag outdated csvtojson versions
• Monitor application memory and behavior for signs of prototype pollution effects
• Implement regular security audits of npm dependencies using tools like npm audit

How to Mitigate CVE-2025-57350

Immediate Actions Required

• Upgrade csvtojson to version 2.0.10 or later immediately
• Audit all applications using csvtojson to identify vulnerable deployments
• Implement input validation to sanitize CSV headers before processing
• Restrict CSV upload capabilities to authenticated users where possible
• Review application logs for any evidence of exploitation attempts

Patch Information

The vulnerability has been addressed in csvtojson version 2.0.10 and later. Organizations should update their dependencies immediately. For more details, see the GitHub Issue #498 which tracks this vulnerability.

To update the package, run:

npm update csvtojson

Verify the installed version meets the minimum requirement:

npm list csvtojson

Workarounds

• Implement a pre-processing layer that sanitizes CSV headers before passing to csvtojson
• Use allowlist validation for expected CSV header names and reject files with unexpected headers
• Deploy web application firewalls (WAF) configured to detect prototype pollution patterns in uploaded files
• Consider using alternative CSV parsing libraries with built-in prototype pollution protections until upgrade is possible

# Configuration example - Check current csvtojson version and update
# List current version
npm list csvtojson

# Update to latest secure version
npm install csvtojson@latest

# Verify update was successful
npm list csvtojson | grep csvtojson