CVE-2026-9673 Overview
CVE-2026-9673 is a CSV Injection vulnerability in the json-2-csv npm package, affecting versions from 3.15.0 and before 5.5.11. The flaw resides in the preventCsvInjection option, which can be bypassed by an attacker. When the bypassed payload is exported to a CSV file and opened in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, embedded formulas execute in the victim's context. This weakness is categorized as [CWE-1236] Improper Neutralization of Formula Elements in a CSV File. Successful exploitation can lead to data exfiltration, arbitrary command execution through spreadsheet functions, or unauthorized network requests originating from the victim's workstation.
Critical Impact
Attackers can inject spreadsheet formulas into generated CSV files, bypassing the preventCsvInjection safeguard and triggering code execution when victims open the file.
Affected Products
- json-2-csv npm package versions 3.15.0 through 5.5.10
- Node.js applications consuming json-2-csv to export user-controlled data
- Downstream applications relying on preventCsvInjection as a protection control
Discovery Timeline
- 2026-05-28 - CVE-2026-9673 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-9673
Vulnerability Analysis
The json-2-csv library converts JSON objects into CSV-formatted output. It exposes a preventCsvInjection option intended to neutralize cells whose values begin with formula trigger characters such as =, +, -, and @. The implementation does not account for all variants an attacker can use to smuggle a formula past the filter. Once the malicious value reaches a spreadsheet application, the application interprets it as a formula rather than literal text. Attackers exploit this to invoke functions such as HYPERLINK, WEBSERVICE, or DDE-style calls to exfiltrate data or pivot further into the user's environment.
Root Cause
The root cause is incomplete input neutralization inside the CSV serialization path of json-2-csv. The preventCsvInjection sanitizer checks for a limited set of leading characters but does not normalize whitespace, control characters, or alternative formula prefixes that spreadsheet engines still treat as executable. The upstream fix is referenced in the GitHub commit and the affected serialization logic in src/json2csv.ts.
Attack Vector
An attacker submits crafted JSON values to any application endpoint that ultimately serializes the data through json-2-csv with preventCsvInjection enabled. The attacker prepends bypass sequences before formula characters so the sanitizer treats the string as safe. When a downstream user opens the resulting CSV in a spreadsheet client, the embedded formula executes. Refer to the Snyk Vulnerability Report and the GitHub Gist Example for proof-of-concept payloads demonstrating the bypass.
Detection Methods for CVE-2026-9673
Indicators of Compromise
- CSV files containing cells whose values resolve to formula prefixes (=, +, -, @, \t, \r) after leading whitespace stripping.
- Outbound network connections from spreadsheet processes such as excel.exe or soffice.bin to attacker-controlled domains following CSV file opens.
- Generated CSV exports containing HYPERLINK, WEBSERVICE, IMPORTXML, or DDE function references in user-controlled fields.
Detection Strategies
- Inventory Node.js projects and scan package-lock.json and yarn.lock for json-2-csv versions between 3.15.0 and 5.5.10.
- Inspect server logs for JSON payloads containing formula trigger characters preceded by bypass sequences submitted to export endpoints.
- Add static analysis rules in CI/CD to flag direct use of json-2-csv without an updated version constraint.
Monitoring Recommendations
- Monitor child process creation from Office and spreadsheet applications, especially cmd.exe, powershell.exe, or bash spawned by excel.exe or soffice.bin.
- Alert on unexpected network egress from spreadsheet processes following document open events.
- Track CSV files generated by backend services that include high-risk function names in cell content.
How to Mitigate CVE-2026-9673
Immediate Actions Required
- Upgrade json-2-csv to version 5.5.11 or later across all Node.js services and rebuild dependent applications.
- Audit recent CSV exports for embedded formulas and notify users who may have opened malicious files.
- Re-enable and verify the preventCsvInjection option after upgrading, and add server-side input validation as defense in depth.
Patch Information
The maintainers fixed the bypass in version 5.5.11 of json-2-csv. The remediation is described in the GitHub Commit Overview and tracked in the Snyk Vulnerability Report. Update the dependency in package.json to ^5.5.11 and run npm install to refresh the lock file.
Workarounds
- Reject or escape JSON field values that begin with =, +, -, @, tab, or carriage return before passing data to json-2-csv.
- Prefix risky cell values with a single quote ' or wrap them in double quotes server-side to force literal interpretation.
- Deliver exports in safer formats such as .xlsx with proper typing, or sign and watermark CSV files so recipients can verify provenance.
# Configuration example: upgrade the vulnerable package
npm install json-2-csv@^5.5.11
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
