Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact With columns: true and groupcolumnsbyname: true, a duplicated proto header causes the duplicate-column branch to assign an array to obj['proto'], invoking the proto setter and replacing the parsed record object's prototype with attacker-controlled data. Fixed in 7.0.2 (Object.hasOwn duplicate check + Object.defineProperty assignment). Patches The problem been patched. Workarounds Disable usage of both the columns and groupcolumnsbyname options. References issue #496, PR #497
Recommended action: Upgrade to 7.0.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Versions of csv-parse prior to 4.4.6 are vulnerable to Regular Expression Denial of Service. The isInt() function contains a malformed regular expression that processes large specially-crafted input very slowly, leading to a Denial of Service. This is triggered when using the cast option. Recommendation Upgrade to version 4.4.6 or later.
Recommended action: Upgrade to 4.4.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.