VDB
CVE-2026-9673
CVE-2026-9673
PUBLISHED
CVSS 7 HIGH
Reported by snyk · Published May 28, 2026
Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.
Risk Scores
CVSS 4.0
7
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | json-2-csv | 3.15.0 |
| n/a | org.webjars.npm:json-2-csv | 0 |
| n/a | org.webjars.npm:json-2-csv | 0, 0, 0 |
| n/a | json-2-csv | 3.15.0, 3.15.0, 3.15.0 |
| wolfi | opensearch-dashboards-3 | 0, 0, 0 |
| chainguard | opensearch-dashboards-3 | 0, 0, 0 |
| chainguard | opensearch-dashboards-3-fips | 0, 0, 0 |
| npm | json-2-csv | 3.15.0 |
Timeline
- May 28, 2026 CVE Published
- May 28, 2026 EPSS Score
- May 29, 2026 EPSS Score
- May 29, 2026 CVE Updated
- May 30, 2026 EPSS Score
- May 30, 2026 Coalition ESS Score
- May 31, 2026 EPSS Score
- Jun 1, 2026 EPSS Score
- Jun 2, 2026 Security Advisory
- Jun 5, 2026 EPSS Score
- Aug 7, 2026 EPSS Score
- Aug 24, 2026 EPSS Score