Detections
Analytics

SCA: security update for csvtojson (GHSA-vrw9-g62v-7fmf)

medium Tenable Self-Hosted Container Security Plugin ID 437249

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The csvtojson package, a tool for converting CSV data to JSON with customizable parsing capabilities,
 contains a prototype pollution vulnerability in versions prior to 2.0.10. This issue arises due to
 insufficient sanitization of nested header names during the parsing process in the parser_jsonarray
 component. When processing CSV input containing specially crafted header fields that reference prototype
 chains (e.g., using __proto__ syntax), the application may unintentionally modify properties of the base
 Object prototype. This vulnerability can lead to denial of service conditions or unexpected behavior in
 applications relying on unmodified prototype chains, particularly when untrusted CSV data is processed.
 The flaw does not require user interaction beyond providing a maliciously constructed CSV file.
 (CVE-2025-57350)

See Also

https://github.com/advisories/GHSA-vrw9-g62v-7fmf

Plugin Details

Severity: Medium

ID: 437249

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/28/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3.9

Percentile: 52.58

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2025-57350

CVSS v3

Risk Factor: High

Base Score: 8.6

Temporal Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/24/2025

Vulnerability Publication Date: 9/24/2025

Reference Information

CVE: CVE-2025-57350