GHSA-g27c-q7cp-mhx6

Suggest an improvement
Source
https://github.com/advisories/GHSA-g27c-q7cp-mhx6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-g27c-q7cp-mhx6/GHSA-g27c-q7cp-mhx6.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-g27c-q7cp-mhx6
Aliases
Downstream
Published
2026-05-28T06:31:09Z
Modified
2026-07-17T21:16:43.190677933Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N CVSS Calculator
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
json-2-csv vulnerable to CSV Injection via the preventCsvInjection optio
Details

Versions of the package json-2-csv from 3.15.0 and before 5.5.11 are vulnerable to CSV Injection via the preventCsvInjection option which can be bypassed. An attacker can inject formulas into CSV files, which execute when the files are opened in spreadsheet applications.

Database specific 
{
    "nvd_published_at": "2026-05-28T06:16:29Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1236"
    ],
    "severity": "MODERATE",
    "github_reviewed_at": "2026-07-01T21:25:23Z"
}
References

Affected packages

npm / json-2-csv

Package

Name
json-2-csv
View open source insights on deps.dev
Purl
pkg:npm/json-2-csv

Affected ranges

Type
SEMVER
Events
Introduced
3.15.0
Fixed
5.5.11

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-g27c-q7cp-mhx6/GHSA-g27c-q7cp-mhx6.json"